Dependency noise turned into one durable question: did the system become less safe?
Sentinel scans npm and Python dependencies, tracks changes over time and reports whether their security status has regressed.
The problem
Raw dependency scan results are noisy and transient. To become operationally useful, they need stable identity, persisted comparison points, triage, and a compact status that other systems can consume.
Design & implementation
Sentinel adds persistent state to a batch scanning workflow. It compares current alerts with previous results and a baseline, applies triage rules, and produces a compact status for other services.
The scanner supports local and SSH-based targets, keeps backward-compatible legacy report status, and adds a separate policy status focused on non-regression. This makes it usable both as a direct CLI tool and as a stateful guardrail.
An integration with Observability Brain brings dependency alerts into the wider operational view, alongside service and infrastructure state.
What it does
- Dependency scanning for npm and Python manifests
- Persisted baseline, latest, and diff state for non-regression tracking
- Triage and policy-based evaluation without hiding alerts
- Compact observability export for downstream systems
Why I built it
Sentinel makes dependency monitoring cumulative: each scan can show what changed, rather than creating another isolated report.
