Sentrail
Sign in
Features

The AI security agent for Supabase & Vercel apps.

Reads your database and code, tells you what's risky before launch, and fixes database issues in one click. Not a wrapper around npm audit. Not a static checklist. A live agent with context on your schema, your auth, your edge functions, and your shipped bundle.

Create a projectSee use cases
sentrail://agent-chat/3f-a9c1
User: audit my production project
Sentinel: Running multi-connector audit...
[ok] GitHub: Scanned 3 repos · 0 service-role keys in client code
[ok] Vercel: 12 env vars classified · 0 public-prefixed secrets
[warn] Supabase: 14 tables checked · 3 without RLS enabled[!!] CRIT public.profiles → RLS disabled · anon read via PostgREST[!!] CRIT service_role key found in src/lib/supabase.ts (client-exposed path)[!] WARN public.user_settings → RLS enabled · 0 policies defined[ok] proposed 3 RLS fixes · awaiting approval→ open project to review
DB scan

Postgres & RLS audit

Checks every table in your public schema for missing RLS and absent policies via the Supabase Management API.

  • Detects tables exposed via PostgREST with no RLS
  • Surfaces Supabase's own security advisor warnings
  • Counts policies per table — catches the silent zero-policy footgun
Code scan

GitHub repo scanning

Connects via GitHub App to search your repos for leaked secrets and dangerous patterns.

  • Finds service-role keys leaked in client-exposed code paths
  • Detects public-prefixed env vars that look like secrets
  • Keeps codebase context fresh for Sentinel chat
Env audit

Vercel environments

Links via Vercel OAuth to audit your deployment environments and classify env var risk.

  • Flags NEXT_PUBLIC_ / VITE_ variables that look like secrets
  • Checks deployment protection settings
  • Cross-correlates leaked env keys with code findings
Agent ops

Sentinel agent

Conversational operator with read-only context on your project. Ask in plain English; get fixes in SQL.

  • Ask about any finding in plain English and get context from the AI agent
  • Drafts migrations you can preview before apply
  • Balances cost and quality across AI providers
Flow

Connect to fixed in fifteen minutes.

No agent install. No CI pipeline. The whole loop runs against your live project with a read-only token until you press Apply.

  1. T+00:00step 1

    Connect

    Create a Project and link Supabase, Vercel, and GitHub via secure OAuth and Apps. No manual tokens.

  2. T+00:04step 2

    Chat

    Ask Sentinel to 'audit my project'. It instantly scans your DB, code, and environments.

  3. T+00:09step 3

    Triage

    Sentinel explains critical findings in plain English with impact summaries, avoiding false positives.

  4. T+00:12step 4

    Fix

    Sentinel drafts exact SQL fixes. You review the dry-run and click to apply.

  5. T+00:15step 5

    Re-verify

    The agent re-scans to verify the fix worked and logs the result to your scan history.

0
Write operations performed without explicit confirmation
3
Connectors supported — Supabase, Vercel, GitHub
11
MCP tools available for coding agents
Diff

Every fix lands as a reviewable migration.

We show you the exact SQL before and after. You approve. We apply. The result is logged to your scan history.

migrations/20240611_profiles_rls.sqlEXPOSED
-- public.profilesGRANT SELECT ON public.profiles TO anon;-- no row-level policies-- email column readable by every visitor$ curl https://acme.supabase.co/rest/v1/profiles?select=email → 200 OK · 18,432 rows
Compare

Built where the legacy stack quietly gives up.

CapabilitySentrailSCA (Snyk, Dependabot)Classic DAST
Read-only by default
Checks RLS and policies per tablepartial
1-click RLS fix with preview
Conversational remediation agent
Built for indie / solo founders
Pricing under $50/mo
Get started

Stop guessing whether RLS is on. Find out in four minutes.

Free during preview. Read-only token. No card. Nothing written without your tap.

Create a projectTalk to a human