Understand risk. Act with evidence.
Security findings you can act on. Source code that stays yours.
DVSentry tests your repositories, web apps and APIs, cloud accounts and AI systems, correlates what it finds, and shows the evidence behind every risk.
- Production scanners run in isolated containers without network access
- Repository tokens are single-use unless you choose to keep them encrypted
- Web tests run only on domains you prove you own
Demo data — no repository connected
Sample security assessment
Security score81/ 100
3 illustrative risks requiring attention
- Why this risk
- Attack path
- Remediation
Evidence preview
Illustrative structure only. This sample is not cryptographically signed.
{"sample": true, "evidence": "normalized finding", "signature": "preview only"}
See it working
Five seconds each, straight from the product.
Recorded in the DVSentry workspace with demo data: no real repository, customer or secret appears.
One connected view
Every layer you ship, assessed in one place.
- Code
- Vulnerable dependencies, code weaknesses, committed secrets and infrastructure as code, with a software bill of materials.
- Web & API
- Passive checks, TLS and header grading, bounded active probes and API schema tests on verified targets.
- Network
- Port discovery and safe OWASP canaries against the hosts you are authorized to test.
- Cloud
- Posture scans of AWS, Azure and Google Cloud accounts with Prowler, using a read-only identity, mapped to CIS, SOC 2 and ISO 27001.
- AI Security
- Prompt injection, data leakage, retrieval poisoning and agent tool misuse, mapped to the OWASP LLM Top 10.
- Resilience
- Controlled fault experiments on development targets, with approval, automatic abort and an emergency stop.
- Containers & Kubernetes
- Container image scans from your registries and Kubernetes posture read through your own agent, linked from code to the workloads running it.
- Burnwatch FinOps
- Cloud and AI spend by service and project, budgets and forecasts, anomalies, and the cost of idle and insecure resources.
- Risk & governance
- One risk inbox across every pillar with owners and SLAs, scorecards, policies and release gates.
- Secure Share
- Send passwords, keys and files as end-to-end encrypted links that expire after a set time or number of views. Your browser encrypts them before upload, so DVSentry never sees the content.
- Password tools
- A password generator and a password vault in your workspace. The vault is encrypted end to end in your browser, so DVSentry cannot read it; it alerts you when an entry changes or a new browser opens it, and checks passwords against known breaches without ever sending them.
- Personal data map (DPDP)
- Finds the personal data your code collects, stores, logs and sends to third parties, shows whether each table can be deleted, maps cloud data stores and builds an erasure runbook. Names and locations only, never the data itself.
- Compliance
- Evidence packs for SOC 2, ISO 27001, DPDP and CERT-In readiness (evidence, not certification), security questionnaires and a Trust Center you publish.
- AI assistance
- Plain-language report summaries, likely false-positive flags, remediation plans and threat-model explanations. Advice only: AI never changes a severity, a status or a release gate.
Every plan shows every pillar; the ones outside your plan stay visible, locked, until you upgrade.
How it works
From connection to proof.
- Connect
A repository, application, cloud account or API.
- Test
Run the checks you are authorized to run.
- Prioritize
Deduplicated risks, ranked by exploitability and reachability.
- Fix
Remediation guidance your developers apply themselves.
- Prove
Export reports, SBOMs and signed evidence.
Fits your pipeline
Scan on every push, from wherever you build.
Start scans by hand, on a schedule, or automatically from your source host and CI.
- GitHub AppScans on push and pull request, with a check on the pull request. Pull-request and push scans are fair use and do not count against the plan.
- GitLab and BitbucketA push webhook per repository starts a scan. Private repositories use a read-only token you keep in Scan credentials.
- Any CICall the versioned public API with a scoped access token, or use the DVSentry CLI, a single Python file with no dependencies.
- Before you commitThe CLI and a pre-commit hook scan a folder on your machine with locally installed open-source scanners, offline.
- Release gatesPolicies decide which findings fail a build, and the result comes back to CI as a pass or fail with the reason.
- Dependency fixesFor npm and pip findings, DVSentry prepares a version-bump patch your developers download, review and apply. Fix pull requests opened by DVSentry are coming.
AI that explains, never decides
Help reading the results, on request.
Every AI feature runs only when asked and labels its output as AI-generated. Managed AI is included from the Cloud & AI plan, or bring your own provider key. Repository scanning itself sends no source code to an AI service.
- Report summariesA developer and an executive summary of a report, what changed since the last scan, a release recommendation and draft tickets.
- TriageFlags findings that look like false positives from their metadata only: the rule, title, severity and file type, never the code.
- Remediation plansA step-by-step plan per scan, and a plain-language explanation of the threat model.
- Code review (opt-in)An Admin can let AI read up to 13 lines around each new code or infrastructure-as-code finding. File paths, repository names and secret values are never sent.
- Coming nextAsk DVSentry, read-only questions about your organization's findings, and grouping of related findings into one fix.
Recently added
What is new.
- Trust CenterA public page on how DVSentry isolates scans, handles data, backs up and which sub-processors it uses, and a record of the policies you have accepted.
- Clearer scan plansThe scan form shows exactly which scanners a run sends and why any planned scanner cannot run. Re-detect refreshes the stack after your repository changes.
- Password generator everywhereOne click from the workspace header, and free on the public site with no sign-up.
- Sign-in codes in the vaultAdd a two-factor code to a vault entry from its QR image. The image is decoded in your browser and never uploaded.
- Signed scanner updatesScanners update only to images signed by DVSentry's own build, verified before they run, and can be rolled back.
- Built for India's DPDP ActConsent and age confirmation at sign-up, one-year security logs and a personal-data breach process. Read the DPDP notice.
Privacy-first security
Your code deserves a clear boundary.
Repository scanning is designed to run without sending source code to third-party AI services. Optional AI integrations operate according to the configured provider and deployment policy.
- Isolated executionProduction scanner containers run as a non-root user with no network, a read-only filesystem and bounded resources.
- Controlled credentialsA repository token is used for one checkout by default. Keeping it for ten minutes, or in the encrypted vault, is your choice.
- Verified scopeWeb and network testing starts only after you prove domain ownership.
- Signed evidenceReports can be exported with a signature you can verify later.
- Shares we cannot readSecure Share encrypts text and files in your browser with AES-256-GCM. The key lives only in the link after "#", which browsers never send to us, plus an optional passphrase. A share is deleted when it expires, runs out of views or is revoked, and there is no recovery, by design. Shared files are not scanned, so the recipient's browser refuses executables, scripts and macros.
- Safe to retryA repeated click, a retried request or a redelivered webhook never starts a duplicate scan or invitation, and never bills you twice.
- Scans survive upgradesA scan still running during a DVSentry upgrade is handed back and restarts on the next worker instead of failing.
Trust Center: isolation, data handling, backups and sub-processors · Security contact and disclosure
Plans
Try Cloud & AI free for 14 days. Pay per developer and per cloud account.
Every price and limit below comes from the DVSentry plan catalog.
Loading current plans…
- No account yet?
- The free public scan checks any public GitHub repository with no sign-up and no card.
- What is a scan?
- A scan is one run of one asset in any pillar: a repository, a web or API target, a cloud account, an AI target or a host. Full scans count against the plan; pull-request and push scans from the GitHub App are fair use and do not.
- Contributing developers
- People who committed to a connected repository in the last 90 days, bots left out. Going over is a soft limit: we ask you to add a pack, nothing stops.
- Members
- The people who can sign in to your organization. Service accounts used by CI are not members.
- Add-on packs
- +5 contributing developers or +1 connected cloud account, sold as packs rather than metered. Burnwatch cloud and AI cost is an add-on on Cloud & AI and Governance and included in Complete.
- After the trial
- An organization that has not chosen a plan moves to Free: two scans in total and one asset of each kind, with every report kept.
- Support
- We offer response targets, not a service level agreement. Complete agrees its response targets by contract.
Serious security, accessible by design.
DVSentry started from a simple idea: developers should not need to build and maintain an entire DevSecOps stack just to understand whether their software is secure.
Make your first connection.
Create an account, verify your email, then choose a repository assessment. Web testing requires ownership verification and explicit authorization.