The scanner that tells you what it didn't check.
AppSentry™ analyzes source code, dependencies, running endpoints and TLS configuration, and puts every finding in one queue on one severity scale. It runs inside your network and sends no code outside it. Each finding comes with a weakness class, evidence and a plain-language fix, and coverage gaps are reported as gaps, never as passes.
What a finding looks like
Every result explains what's wrong, how sure the scanner is, whether attackers are using it, and how to fix it.
- Weakness
- CWE-89 · OWASP A03 Injection
- Confidence
- High: an untrusted value reaches the query
- Location
billing/reports.py:214- Fix
- Pass the value as a bound parameter.
- Advisory
- CVE-2021-44228 (log4j-core)
- Likelihood
- EPSS 99th percentile · listed in CISA KEV
- Severity
- Raised from High on exploit evidence
- Fix
- Upgrade to a fixed release.
Four surfaces, one findings model
Source code
Ten languages: Python, JavaScript/TypeScript, Java, Go, PHP, C#, Ruby, Kotlin, COBOL and RPG. Python is parsed into a full syntax tree; others use a token scanner. Nothing is executed.
Dependencies
Known vulnerabilities, license obligations and end-of-life status across npm, PyPI, Maven, NuGet, Go, RubyGems, Packagist and crates.io, with a cross-project inventory.
Running application
Live endpoint checks and OpenAPI/Swagger analysis: security headers, cookie flags, HTTP method exposure, TRACE and error disclosure.
Server configuration
TLS/SSL analysis for public and internal hosts: protocol versions, cipher selection, certificate chain and expiry.
Secrets
Credential signatures and a high-entropy detector across all text files. Matches are redacted in every report, export and log.
Results from other tools
SARIF from your existing scanners imports into the same model, and every finding maps to the CWE catalogue and OWASP Top 10.
Severity is three questions, not one
Severity
How bad would exploitation be?
Confidence
How certain is the scanner that the finding is real?
Exploitation
Is anyone exploiting it? Drawn from EPSS and CISA KEV on your schedule. Unknown stays unknown, not zero.
A clean report is only worth what the scan behind it could do
- Capabilities that were off, unavailable or couldn't reach their target are reported as not assessed, never as clean.
- Dependencies without license data are marked undetermined, with a place to record the answer.
- Suppressions require an owner and a reason, and stay in the audit trail.
- AI-assisted explanation and triage are optional and off by default.
Self-hosted, and quiet about it
Your network, your data
Installs where your code lives. Source is read in place and never transmitted.
Command line and dashboard
One engine. The dashboard adds program-level views, triage history and reporting.
Deployment
Container image and Kubernetes Helm chart. SQLite for one team, PostgreSQL for an estate.
Pipeline support
JSON, SARIF and SBOM output, a token-authenticated REST API, and per-job failure gates.
Old codebases
Baseline and diff mode gates only on new findings.
Access control
OIDC single sign-on, role-based access, per-project scoping and an audit log.
Asked before
Does source code leave the network?
No. There is no upload step and no vendor telemetry.
Does this replace a penetration test?
No. It answers different questions than a human tester does.
Why another scanner?
You can keep your existing scanners: their SARIF results import into the same queue.
How noisy is it?
Confidence is separate from severity, first-party code is distinguished from vendored and generated code, and baseline mode gates only on new findings.
Do finding IDs change between scans?
No. Fingerprints come from the rule, file and matched code, not the line number.
Who owns the software?
AppSentry™ is Strat Cyber Advisors' original work. Rules were written from scratch, the engine uses only the Python standard library, and no third-party rule sets are included.
See AppSentry™ on your own code
We'll walk through a scan inside your environment. Nothing leaves your network.
AppSentry™ is a self-hosted application security scanner and a trademark of Strat Cyber Advisors. CWE is a trademark of The MITRE Corporation; OWASP is a trademark of the OWASP Foundation.
Part of Apps You Can Trust from Strat Cyber Advisors.
Strat Cyber
Need cybersecurity support? Share your project details. We're here to safeguard your digital assets.
Join free to unlock in-depth readiness assessments, executive and vendor toolkits, advisories and the briefing archive.