Scanners

Sentinel ships 21 core scanners and 13 additional Pro scanners — 34 total. All run locally — nothing is sent to a server.

Core tier — 21 scanners

CodeWatch

81-scope static integrity checker — secrets, SQL injection, type safety, dead code, N+1 queries.

GapWatch

Finds stub functions, placeholder values, hardcoded literals, and doc drift.

SecurityWatch

Secret leaks, injection vectors, insecure dependencies, OWASP Top 10 patterns.

TestWatch

Tracks untested functions, enforces test-alongside, reports coverage gaps.

TestQualityWatch

Vacuous tests, assertion-free tests, try/except-pass patterns, test rot.

PerformanceWatch

N+1 queries, unbounded loops, missing pagination, slow startup paths.

SilentFailureWatch

Bare except, swallowed errors, missing error logging, false-positive early returns.

InvariantWatch

Broken invariants, missing pre/post-conditions, state corruption patterns.

ChangeRiskWatch

Large diffs, risky refactors, missing rollback paths, blast-radius scoring.

InterfaceContractWatch

API contract drift, schema mismatches, breaking changes without version bumps.

ConfigWatch

Hardcoded URLs, missing env vars, timeout misconfigurations, secret in config.

DocumentationWatch

Missing docstrings on public APIs, stale comments, doc/code divergence.

StateConcurrencyWatch

Race conditions, shared mutable state, missing locks, async misuse.

ReachabilityWatch

Dead code, unreachable branches, unused exports, zombie feature flags.

VersionWatch

Dependency version drift, pinned-but-outdated packages, CVE exposure.

LLMPromptQualityWatch

Prompt injection risk, missing system prompts, unconstrained model outputs.

AsyncPatternWatch

Floating promises, missing await, sync-in-async, event loop blocking.

TimezoneWatch

Naive datetime usage, timezone-unaware comparisons, DST edge cases.

InputValidationWatch

Missing boundary validation, trust of internal data, injection at API edges.

HttpClientHygieneWatch

Missing timeouts, no retry logic, hardcoded base URLs, unhandled 4xx/5xx.

DatetimeWatch

Date arithmetic errors, format string bugs, locale-sensitive comparisons.

Pro tier — 13 additional scanners

SupplyChainWatch

Dependency provenance, typosquatting risk, unpinned transitive deps.

DependencyFreshnessWatch

Outdated packages, EOL runtimes, major version lag.

MigrationWatch

Irreversible migrations, missing rollback, data-destructive schema ops.

SchemaWatch

Schema drift between code and DB, missing indexes, nullable violations.

ObservabilityWatch

Missing structured logging, no metrics on critical paths, silent errors.

ResilienceWatch

Missing circuit breakers, no retry on transient failures, thundering herd.

DataIntegrityWatch

Missing transactions, double-spend risk, non-atomic multi-step ops.

LogFormatWatch

Unstructured log output, missing log levels, PII in logs.

MemoryLeakWatch

Unclosed resources, growing caches, reference cycles, weak ref misuse.

FixtureDataWatch

Hardcoded test data, production data in tests, fixture staleness.

TypeAnnotationWatch

Missing type hints, bare Any, incomplete generics, Union abuse.

DockerfileWatch

Privileged containers, no health check, latest tag, secret in layer.

ErrorMessageQualityWatch

Vague error messages, missing context, no actionable remediation.