Repository navigation
Sentinel's own findings fixed, plus Ruby and Go coverage - #1754
Merged
keshav55 merged 8 commits intoNov 6, 2026
Merged
Conversation
…s machine Sentinel's first full run on this repo confirmed both: the token prompt printed the pasted credential, and site deploy sent the login token over any http base. Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
…runs a full pass takes Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
Codex review: with stdout sent to a file, readline fell back to plain mode and the terminal echoed the typed token. Secret prompts now keep terminal mode and write the prompt to stderr when that is the screen. Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
…o the owner The phone app audit sent a library-version question to the owner while the installed version sat in the project's venv. Hunters and checkers now read lockfiles, venvs, and node_modules first. Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
…ifests Planning a Ruby crypto library found 0 areas and a Ruby GraphQL authorization library found 4: the detectors only knew JavaScript and Python shapes. Now 12 and 35. A Python repo stays at 30 areas. Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
…way it batches The ropenpgp run filed one defect twice, under two classes with two names, and spent two checks on it. Candidates with the same function in the fingerprint and sinks within three lines now merge before verification. From review: the run estimate now counts batches per class and subsystem, a tiny budget says it cannot send a hunter instead of 'about Infinity runs', the Ruby 'def authorized?' pattern matches, and bare sign()/pad() no longer pull files into the crypto review. Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
Co-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>
keshav55
deleted the
codex/claude-sentinel-self-fixes-and-rsi-20261106-220348
branch
November 6, 2026 23:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sentinel's first full runs, then what they taught it.
Fixed in this CLI (confirmed by sentinel, checked by a second model):
site deploy --api-base http://...sent the login token unencrypted to any host. Plain http is now loopback only.Sentinel improvements from real runs:
Tests: sentinel 20, secret prompt and deploy 3, site deploy 17, all passing.