Sentinel AI

The description states that Sentinel AI:

• Scans GitHub repositories.
• Uses 8 deterministic static detectors for vulnerability detection.
• Explains findings using an AI reasoning layer (not hallucinating new issues).
• Offers tiered remediation: auto-fixes for low-risk issues, human review required for high-risk ones.
• Never pushes directly to default branches; all fixes land as pull requests.
• Is built with a Next.js frontend, FastAPI backend, and scan worker on Railway.

It is described as a live, end-to-end application where users authenticate via GitHub, scan repositories, and receive actionable findings and remediations. The tool is not claimed to be a SaaS product or platform for others to use beyond its own testing.

Inference The author built the tool using Codex (OpenAI’s code generation tool) across 10 sessions, with validation against an intentionally vulnerable sample application. This suggests a prototype-level implementation rather than a scalable product.

The author positions Sentinel AI as:

• A solution to security gaps in AI-assisted development.
• A first-line defense for developers building with AI tools.
• An autonomous remediation loop that detects and fixes vulnerabilities in AI-generated code.

Claims include:

• Traditional scanners are blind to AI-specific threats like indirect prompt injection, data poisoning, or unsafe model deserialization.
• Sentinel AI focuses on static detection of known failure modes (e.g., hardcoded secrets, backdoors).
• It avoids hallucinations by ensuring AI explanations only reference what was statically detected.

Inference The positioning evolved from a general concern about AI-driven software security to a specific tool targeting AI-generated code vulnerabilities. The author chose not to claim capabilities like detecting training data manipulation or model weight attacks, which they deemed outside the current scope.

The description states:

• Sentinel AI is aimed at developers working with AI coding assistants.
• It targets teams building applications using AI tools that generate large amounts of code.
• The tool assumes users are already using AI agents in their development workflow and want to secure that output.

Inference The target customer appears to be individual developers or small teams who use AI coding assistants and are concerned about the security implications of AI-generated code. There is no evidence of enterprise adoption, B2B customers, or a defined ICP beyond this general audience.

There is no evidence in the description of:

• A pricing model.
• Revenue streams.
• Subscription plans.
• Monetization strategy.
• Customer acquisition or retention mechanisms.

The tool is described as a live prototype with no indication it has been monetized or offered to users beyond its own testing.

The description states:

• Built using: gemi, gemini, github-oauth, gpt5.6, node.js, postgresql, python, redis, typescript.
• The AI reasoning layer uses Google’s Gemini API (switchable to GPT-5.6).
• Deployment stack includes Next.js frontend on Vercel, FastAPI backend and scan worker on Railway, PostgreSQL on Neon, Redis on Upstash.
• The tool is fully deployed and testable by anyone.

Inference The technical stack indicates a modern, cloud-native architecture with a focus on developer experience. However, the author notes that production deployment revealed several bugs not visible in local development — suggesting early-stage engineering maturity.

The description states:

• A fully working, verified, live product (not a mockup).
• Real PRs opened on a real GitHub repository.
• A 10-finding scan against an intentionally planted vulnerability set.
• AI-generated explanations that can be pointed to as evidence.

The description does not mention:

• Direct competitors.
• Existing tools in the AI security space.
• Market positioning relative to other vulnerability scanners or AI safety platforms.

Inference While Sentinel AI addresses a niche within AI-assisted development, there is no evidence of how it compares to existing tools or whether it fills an unmet market need. The author does not reference any competitive landscape.

Key risks and red flags based on the description:

• Unproven accuracy: The author admits that detectors were improved after testing against a real vulnerable app, suggesting early-stage detection gaps.
• Limited scope: The tool focuses only on static detection of known failure modes; it does not claim to detect training data manipulation or model internals.
• Single-person team: The entire project was built by one person (Oluwafunmilayo Ishola), raising questions about scalability and long-term maintenance.
• No monetization strategy: No evidence of a business model, pricing, or customer acquisition plan.
• Deployment complexity: Bugs surfaced only in production, indicating potential engineering challenges at scale.

1. How many real-world vulnerabilities have your static detectors actually caught outside of your own testing?
2. What is the false-positive rate for your detectors, and how do you validate that?
3. Can you demonstrate a case where your tool detected a vulnerability in code not generated by AI?
4. Have you tested your tool against real open-source projects or enterprise codebases?
5. What is your plan to scale beyond a single-person development team?
6. How do you intend to monetize this product, and what are your go-to-market strategies?