Getting started

This page takes you from a new account to your first finished scan. It is written for everyone who uses DVSentry: developers, security engineers and the people who manage an organization.

#What DVSentry is

DVSentry is a privacy-first security platform. One account covers seven areas, called pillars:

Results from every pillar land in the same place: reports, findings, the risk inbox, scorecards and compliance evidence.

Four principles hold everywhere:

• Read-only by default. DVSentry never changes your repositories, cloud accounts or targets unless you explicitly ask for a write (for example a fix pull request), and cloud identities are read-only.
• Proof before testing. A website, API or AI endpoint is tested only after you prove you own its domain. Resilience faults run only through an agent you installed, on targets you pinned.
• Honest results. A scanner that did not run, timed out or could not read something is shown as such. Missing coverage is never presented as a clean result.
• Your source stays inside the scan boundary. Code is cloned into a temporary workspace, scanned in an isolated container with no network, and the workspace is removed afterwards.

#Step 1: create your account

1. Open the sign-up page (/signup) and enter your name, a username, your email address and a password. Accept the Terms, the Acceptable Use Policy and the Privacy Policy.
2. DVSentry emails you a 6-digit code. Enter it on the account page within 10 minutes. The email carries only the code, never a link. Five wrong attempts lock the code; request a new one.
3. Sign in. A private organization is created for you, and a new organization starts a 14-day trial of the Cloud & AI features (once per person; see Billing and plans).

Sessions last 12 hours. Tick Keep me signed in for a 30-day session that renews while you use it.

#Step 2: turn on two-factor sign-in (MFA)

Owners and Admins must use MFA, and an organization can require it for everyone.

1. Open Settings → Account Security → Set up MFA.
2. Add the secret to any TOTP authenticator app and enter the 6-digit code.
3. Save the recovery codes offline. Each works once; DVSentry cannot show them again.

Sensitive actions (creating tokens, publishing a Trust Center, changing billing, opening the password vault for the first time in a session) ask for a fresh code even when you are signed in. This is a step-up. Review and revoke your sessions under Account Security.

Passkeys. Where passkeys are available, you can add a passkey (security key, Touch ID, Windows Hello) as a stand-in for the TOTP code, and optionally sign in with it. A passkey can only be added to an account that already has TOTP MFA.

#Step 3: your organization, members and roles

Everything (repositories, targets, cloud accounts, reports, policies, credentials) belongs to an organization. Members of one organization never see another organization's data: a resource from another organization answers "not found", so even its existence is hidden.

Under Organization, an Admin invites members by email and gives each a role:

• The invitation email has a single-use link (/app?invite=...) valid for 7 days, only for the invited address. An organization holds at most 25 open invitations.
• Teams limit which repositories a member sees.
• Single sign-on (OIDC, SAML) and SCIM provisioning are described in Governance and compliance.

#Step 4: your first scan in five minutes

1. Open Repository Security.
2. Paste a public repository URL, for example https://github.com/OWASP/NodeGoat, and the branch master.
3. Choose Detect stack & build scan plan. DVSentry clones the repository, detects languages and tools, and shows which scanners apply.
4. Keep the mode Smart, give the report a name such as NodeGoat first scan, and choose Run.
5. Watch the progress page: each scanner shows queued, running, finished, skipped or stopped, with time used. You can leave the page and come back.
6. When it finishes, open the report from Reports and read the top findings and their fixes.

Next:

• Verify your domain under Domain Verification so you can test your website (Web and network).
• Set a policy so the report has a pass/fail answer for CI (Policies and gates).
• Connect CI so every build is scanned (CI pipelines).

#Where to find things

The sidebar groups pages by area (/app/...):

This documentation is at /docs, and the API reference at /api-reference.

#Feature availability

Some features are not available to every organization yet, and some need a third-party connection (for example the Slack app or the GitHub App). When a feature is not available, its page says so and why ("not configured", "not on your plan"); it never fails silently. Features marked Not verified live in this documentation are built and tested but have not yet been exercised against the real third party.

Something missing or unclear? Tell us with Feedback in the app.