Everything about how Sentesting works, stays safe, and handles your data.
Four layers: Atlas statically analyses source and dependencies; Ares combines an authorised repository with its DNS-verified staging application for aggressive, source-aware testing; Shield analyses and hardens Android APKs; and Aegis adds on-device runtime protection to shipped apps.
No. Atlas takes a repository, Ares pairs a repository with a staging URL you own, and Shield takes an APK. There is nothing to embed in your application.
Atlas and the mobile engines usually finish quickly. Ares is an iterative agentic penetration test, so its runtime depends on the application and can be longer than a deterministic scan. Live progress appears in the scan dashboard.
Atlas parses Python, JavaScript, TypeScript, Go, Java, and Ruby to a full AST, with framework awareness for common web stacks. Shield covers Android (APK); iOS is on the roadmap.
Atlas doesn't pattern-match on strings. It builds a call graph and follows tainted data from a source to a dangerous sink, so it only raises a finding when a real, reachable path connects them. That's why the false-positive rate is a fraction of a typical rules-based SAST tool, and why every result comes with a reachability path, not just a line number.
Yes. Connect the GitHub App and Atlas or Ares can clone a private repository with a scoped, short-lived token. We retain the installation identifier, not a long-lived GitHub credential. Atlas also supports uploads when you do not want to connect a repository.
Aegis hardens a built Android app after compilation and before your signing step — it injects on-device defenses (root, debugger, emulator, hook, tamper, proxy, MITM-CA and screen-capture checks) that evaluate live device state at runtime. Each check can report, warn, redirect, or terminate. It runs inside your CI with no SDK and no code change, and because a phone can't be trusted, protected builds attest their findings to your backend for a server-side decision.
Proven on a real device. We install a protected build on an Android emulator and confirm the checks fire and respond — for example, a proxy-detection check that stays silent until a proxy is actually set, and FLAG_SECURE that blanks screenshots. Not just that a valid APK is produced.
No. Aegis produces an unsigned protected APK and hands it back to you; you sign it with your own key as the very next step in your pipeline. The artifact that reaches the store carries your signature, and your key never leaves your environment. An on-prem container is available for teams that can't send builds off their network at all.
Shield audits and (on request) hardens a build before release — MASVS analysis plus reversible bytecode transforms, rebuilt and re-signed with a change report. Aegis arms a build with runtime defenses that keep working in the field after it ships. Many teams run Shield in review and Aegis in the release pipeline.
Ares is authorization-gated: it requires both an approved source repository and DNS-TXT ownership of the live host, then applies scope and address checks that block private, loopback, link-local, and cloud-metadata ranges. Ares is intentionally aggressive and may submit forms, create test data, or validate an exploit, so it must run against a disposable staging environment rather than production.
Ares has strict authorization and SSRF controls, but the scan itself is aggressive. Use a disposable staging copy with test accounts, test data, backups, and no production credentials. Do not point Ares at production.
Sentesting does not use your source, findings, or reports to train models. Atlas remains deterministic. Ares sends the authorised source context and live application interactions needed for the scan to the configured Gemini model provider; review the Privacy Policy before running it.
Processing is region-aware, and scan artifacts can be deleted on request. Enterprise plans support private or in-region deployment.
Detected secrets are reported with redacted evidence — enough to locate and rotate them, never the full value in plaintext exports.
Yes. Scan artifacts can be deleted on request, and uploaded builds and cloned source are removed once a scan completes. Enterprise plans support private or in-region deployment if data residency is a hard requirement.
Yes — the Starter plan is free forever with three engines (Atlas, Ares, and Shield) and two scans of each per month. Aegis runtime protection is on the paid plans. No credit card required.
The `sentesting` CLI runs in any pipeline: `sentesting scan --repo <repo> --wait --fail-on high` exits non-zero when findings breach your threshold, so builds fail on their own. `sentesting sarif <scan-id> -o results.sarif` produces SARIF 2.1.0 for GitHub/GitLab security tabs. Slack and email alerting are on the roadmap.
HTML and JSON on every plan; audit-grade PDF exports on Shipper and above. Findings are CWE- and OWASP-mapped for compliance reviews.
SSO/SAML, RBAC, and an audit log are available on the Enterprise plan.
Starter is free forever. Paid plans are monthly or yearly (yearly saves ~20%) and you can change plans anytime in-app — upgrades are prorated, downgrades take effect at the next cycle. Need more volume without a full plan change? One-time scan credit packs are available in the dashboard.
A single run of one engine counts as one scan. For Ares, the repository and its verified staging URL are the two required inputs to one combined Ares scan. Running another engine or re-scanning after a fix is a new scan. Quota is tracked per engine per month.
Yearly billing saves about 20% over monthly, and we work with early-stage startups and educational users case by case — reach out via the contact page and tell us about your project.
Our team is happy to help — or just start scanning and see for yourself.