Ready
Every required check has fresh evidence and there are zero open critical or high findings.
Workflow guide
Launch readiness
Understand Sentrail's seven required checks, 24-hour evidence window, four verdict states, score behavior, blockers, and explicit limitations.
Updated August 17, 2026
What the verdict certifies
A ready verdict means the required connections are active, every required check has current evidence, and no open critical or high finding exists in that evidence. The default freshness window is 24 hours.
The seven required checks
Connectivity
Needs Supabase + GitHub
Confirms the connectors an audit depends on are actually active, so no verdict is ever computed with a blind spot.
Database RLS
Needs Supabase
Reads every non-system table and its policy count to catch tables with Row Level Security off, and tables with RLS on but zero policies.
Supabase advisors
Needs Supabase
Pulls Supabase's own security and performance advisor lints — exposed views, definer functions, unsafe function search paths, auth configuration.
Code scan
Needs GitHub
Searches your connected repositories for service-role keys and other credentials sitting in client-reachable paths or public-prefixed env vars.
High-risk file review
Needs GitHub
Locates and reads the security-critical files — auth handling, middleware, webhooks, env plumbing, migrations — and reviews what they actually do.
Dependency audit
Needs GitHub
Resolves your package manifests and checks each dependency against the OSV vulnerability database for known advisories.
Deployment posture
Needs Vercel
Classifies deployment environment variables by risk and inspects deployment protection settings on the hosting side.
The four verdict states
Needs review
Evidence is complete and nothing critical or high is open, but medium and low findings are waiting on a human decision.
Blocked
Evidence is complete and at least one open critical or high finding stands between you and launch.
Insufficient evidence
One or more required checks has never run, failed, or has gone stale — so no score is reported at all.
How the score relates to the verdict
The verdict is the safety boundary; the score is supporting detail. Critical and high findings block launch. Medium and low findings cap the result at needs review. Missing required evidence removes the score entirely.
A truncated evidence set cannot certify ready. When Sentrail cannot inspect the complete required scope, it lowers the result rather than treating an incomplete sample as representative.
What ready does not mean
- It is not proof that the application has no vulnerabilities.
- It does not mean the optional deep Semgrep, Gitleaks, and OSV scan ran.
- It does not include DAST-lite or the LLM-wiring audit unless those were run separately.
- It is not a human code review, penetration test, or compliance certification.
- It covers the connected systems and evidence available at the scored commit and time.