Technical Guide: Scanning SaaS Codebases with Sentrint

Practical Summary of Sentrint

Sentrint is a security analysis tool designed to scan software repositories for vulnerabilities and leaked credentials. It provides a structured security verdict, grading codebases based on the severity and weight of identified issues. The tool categorizes findings into code-level vulnerabilities and dependency-related advisories, assigning a score that helps developers prioritize remediation. By providing actionable, AI-ready prompts, Sentrint aims to streamline the process of fixing security gaps before deployment. It is intended for developers and security teams who need to maintain the integrity of their SaaS applications by identifying hardcoded secrets, insecure coding patterns, and outdated dependencies.

Prerequisites and Input Preparation

To utilize Sentrint, users must have access to a repository URL. The tool is designed to handle public repositories, though it emphasizes that it does not publish a stranger's live credentials. Before initiating a scan, users should ensure their codebase is in a state where it can be analyzed, meaning the repository should be accessible to the tool. Users should be prepared to handle the output, which includes specific file paths and line numbers where vulnerabilities exist. Because the tool provides remediation prompts, users should have an AI coding assistant or IDE ready to apply the suggested fixes, as the tool is designed to integrate with various AI coding tools.

Documented Workflow and Remediation

The Sentrint workflow begins with a scan of the provided repository URL. Once the scan is complete, the tool generates a report that assigns a security verdict and a grade. The report breaks down findings by severity, including Critical, High, and Medium categories. A core component of the workflow is the generation of a fix prompt, which can be copied and pasted into AI coding tools like Claude Code, Cursor, or ChatGPT. This prompt includes specific instructions for fixing vulnerabilities, such as replacing hardcoded secrets with environment variables or upgrading vulnerable dependencies. The tool explicitly distinguishes between code edits and manual credential rotation, providing clear steps for both.

Handling Leaked Credentials

Sentrint places a high priority on leaked credentials, which are marked with a key icon in the report. The tool provides specific, manual instructions for rotating these secrets, as it notes that an AI tool cannot perform these actions on behalf of the user. For third-party API keys, the user must log in to the service provider, revoke the compromised key, and generate a new one. For application secret keys, the user must generate a new random value and store it in an environment variable. The documentation emphasizes that changing the code is insufficient because the value remains in the git history, necessitating a full rotation of the credential.

# Fix 10 security vulnerabilities **7 CRITICAL** — exploitable now, fix these first · **3 HIGH** — fix before your next deploy > 🔑 4 of these are **leaked credentials**. Those need manual steps from you (marked below) — an AI tool cannot rotate keys for you.

Dependency Management and Advisories

Beyond code-level vulnerabilities, Sentrint identifies issues within project dependencies. The tool provides specific instructions for updating packages based on the project's package manager, such as npm, pnpm, poetry, or pip. It warns against editing generated lockfiles by hand, advising users to edit manifest files like requirements.txt directly and then run the appropriate install command. If a vulnerable package is transitive and lacks a direct patch, the tool suggests pinning the patched version through the manifest using overrides or resolutions. Users are instructed to re-run tests after every dependency update to ensure the application remains stable and functional.

Limitations and Best Practices

Sentrint operates under strict ground rules to prevent the introduction of new issues during remediation. Users are advised to change only the lines necessary for a fix, avoiding unnecessary refactoring or renaming. The tool explicitly warns against editing generated files, such as build artifacts or vendor directories, and instead directs users to fix the source that produces them. Furthermore, the tool acknowledges its own limitations: it cannot reset leaked keys or perform actions within third-party dashboards. Users are encouraged to maintain project notes that include rules for validating user-supplied paths and prohibiting the storage of secrets in source files to prevent future regressions.