DVSentry documentation
DVSentry is a privacy-first security platform: repository, web, cloud, infrastructure, AI and resilience security, cloud and AI cost, and a personal data map for India's DPDP Act, in one account. This guide covers everything you need to use it, from your first scan to connecting DVSentry to your CI. Examples are copy-and-paste ready.
For everyone who uses DVSentry
| Page | What it covers |
|---|---|
| Getting started | Account, email code, MFA and passkeys, organizations and roles, your first scan, where things are |
| Repository scans | Hosts and tokens, Smart/Full/Custom, every scanner, Git history depth, incremental scans, time limits and the queue, container images, SBOM re-check |
| Reports and findings | Report tabs, finding states, regression, AI triage versus AI remediation, risk inbox, exports |
| Policies, exceptions and release gates | Policies, posture rules, exceptions, the CI result, the GitHub check, release gates |
| Fixing findings | Patch download, fix pull requests, fix bundles |
| Web and network | Domain proof, targets, DAST modes, signed-in testing, API specs, EASM, schedules |
| Cloud | Keyless AWS, Azure and Google Cloud, scans, topology, drift, detections, identity paths, code to cloud |
| Infrastructure | One-command agent install, host posture, packages, Kubernetes node checks, Falco |
| AI security | AI targets and formats, scans, reading AI findings, case packs, AI-BOM, guardrail API |
| Resilience | Safety model, agent, faults, approvals, GameDays, signed reports |
| Burnwatch | Cloud cost read, budgets, explorer, insecure and idle cost, AI usage, estimates |
| DPDP and personal data | DPDP overview, data map, can it be deleted, the personal data release rule, the DPDP evidence pack |
| Governance and compliance | Scorecards, portfolio, compliance packs, Trust Center, audit log, SSO, SAML, SCIM |
| Password tools and secure share | Generator, vault with TOTP and breach checks, secure share |
| Notifications and integrations | Email, Slack and Teams, signed webhooks, Jira and GitHub Issues |
| Billing and plans | Plans, limits, what counts, add-ons, paying, GST |
| Support and troubleshooting | Error table and FAQ |
For developers and integrators
| Page | What it covers |
|---|---|
| API, tokens and service accounts | /v1, personal access tokens, scopes, service accounts, idempotency, errors, curl examples |
The dvsentry.py CLI | Every command, options and exit codes, offline local scan, pre-commit hook, VS Code extension |
| CI pipelines | GitHub Actions, GitLab CI, Jenkins, Bitbucket, Azure Pipelines, curl-only, SARIF |
| GitHub App | Scans on push and pull request, the check |
| GitLab and Bitbucket push webhooks | Scan every push to a branch, private repositories with a stored token |
The API reference generated from the OpenAPI document is at /api-reference.
Status words used in this guide
- Not configured: the feature needs a third-party connection that is not set up yet; the app says so.
- Not verified live: built and tested, but not yet exercised against the real third party.
Not verified live (as of 2026-11-02)
- Fix pull requests and fix bundles (the DVSentry Fix App is not set up yet).
- Secure share.
- Service accounts, fine-grained token scopes and the token IP allow-list (API only, no settings page yet).
- OIDC SSO, SAML and SCIM; passkeys.
- Outbound webhooks, Jira/GitHub Issues sync, audit log export and streams.
- GitLab and Bitbucket push webhooks (tested with recorded deliveries, not yet against gitlab.com or bitbucket.org).
- Speech AI targets (registration only; assessment not built).
- Burnwatch display currency; Deepgram/ElevenLabs provider keys.
- Card payments outside India (the beta uses Cashfree).
Your organization's settings show which features are available to you; a feature that is not available says why.
Something missing or unclear? Tell us with Feedback in the app.