See your site the way an attacker sees it.
61 probes across seven layers, every week, with no agent and without touching your server.
Every finding comes with severity, technical evidence and what to do about it. At the end, a score from A to F and the diff against the previous audit.
No agent · non-invasive · you authorize the domain before the audit
−6 points since the previous audit. 1 new finding, 3 resolved.
Technical honesty
What this is, and what it is not.
It is external ASM: non-invasive observation of the surface your domain exposes to the internet.
It is not a pentest. We do not exploit vulnerabilities, we do not brute-force, we do not try to bypass authentication.
For penetration testing you want a human pentester — and we help by pointing out the obvious before they charge a lot to point out the same.
Sentinela is there to see and warn, not to intercept. Fail-safe and fail-loud: a probe that fails becomes an informational finding, never silence.
Three layers, one platform
A scanner stops at the eye. CTEM crosses all three.
Detecting is the easy part. What changes the game is turning the finding into priced risk and closing the loop through to the fix.
Eyes
They discover what exists.
54 native PHP probes, with no external binary — network, TLS, headers, email, exposure, privacy and cloud. Where the industry has already solved it, we wrap what is good: CVE templates, SAST, IaC.
See the 61 probes →Brain
They turn it into priced risk.
A technical A-to-F score comparable across targets, plus contextual risk by business criticality, CISA KEV and EPSS — and exposure in R$/year using real downtime from Uptime.
See scoring and financial risk →Arms
They close the loop through to the fix.
Each finding becomes a remediation task with an owner and a deadline, MTTR per workspace, a Jira issue and break-the-build via SARIF on GitHub Actions. It does not stop at the report.
See remediation and CI/CD →Most ASM tools stop at the eye: they deliver a list. The complete loop is what connects the three.
How it works
61 probes across 7 distinct layers.
Website security isn’t one thing. Each layer has its own set of specialized probes observing a different aspect of your domain’s external surface. 49 observe from outside with nothing to configure, 9 are opt-in (white-box, dependencies, Vercel and breach data) and 3 OSINT unlock by plan.
Layer 1 Network & reach 5 probes How the target presents itself on the internet — DNS, open ports, reputation.
- DNS NS health, propagation, record consistency and resolution.
- DNS Security CAA records (certificate issuance control, MEDIUM if absent) and AXFR zone transfer over TCP (CRITICAL if allowed — exposes the entire DNS zone).
- DNSSEC Checks DNSSEC via DNS-over-HTTPS (Cloudflare DoH). Detects domains without DS/DNSKEY (MEDIUM) or with a broken chain — DS present but AD bit absent (HIGH).
- Ports (TCP) Top-30 TCP scan + banner grabbing. Gated by explicit authorization.
- Reputation Spamhaus DNSBL + optional Google Safe Browsing.
Layer 2 Web application 37 probes How your application responds to a visitor (or attacker).
- TLS / Certificate Versions (TLS 1.0/1.1 deprecated, TLS 1.3 missing), ciphers, expiry, hostname, signature, OCSP.
- HTTP headers HSTS (preload, includeSubDomains), CSP (unsafe-inline, wildcards, Trusted Types), COOP/COEP/CORP, HTTPS redirect, version disclosure.
- Cookies Secure, HttpOnly, SameSite, __Host-/__Secure- prefixes on session cookies.
- Path exposure .env, .git, dumps, logs, dependency lockfiles (composer.lock, package-lock.json, yarn.lock, pnpm-lock.yaml — exact pinned versions enable precise CVE targeting), OIDC discovery (/.well-known/openid-configuration), healthchecks (/actuator/health, /readyz), security.txt presence.
- Sensitive file discovery Catches leaks the ExposureProbe misses because they use unpredictable names (dump_2026_xyz.sql, instance_db_hash.sql.gz). Detects open directory listing (Apache/nginx/IIS/Caddy autoindex) on 18 common backup paths and cross-references HTML/robots.txt/sitemap.xml for links with sensitive extensions. Validates via fingerprint (SQL keywords, gzip/zip/SQLite magic bytes, KEY=value format in .env).
- JS Bundle Secrets in bundle, public source maps, vulnerable libs (jQuery, Bootstrap, Vue 2, Moment.js), missing SRI, mixed content, CSRF in POST forms.
- Source Leak PEM keys in HTML (CRITICAL), connection strings with credentials (CRITICAL), credentials in HTML comments (HIGH), RFC 1918 IPs in inline scripts (MEDIUM). Filters placeholders.
- Error page Stack trace exposed on 404/500: Laravel/Whoops, Symfony, Django, Rails, ASP.NET, Express.
- WordPress Version, plugins (wordlist 250+, 100/scan), themes, XML-RPC, user enum, debug.log. CVE matching via Wordfence Intelligence — 100k+ vulns with CVSS, daily sync. Automatic EPSS + CISA KEV enrichment.
- WP cron wp-cron.php health without ever triggering the cron: 403 (scheduling locked by a WAF) is MEDIUM; cron declared disabled with no evidence of an external cron, HIGH.
- WP cache Passive heuristic over the homepage headers — no extra request. No cache headers at all (likely no plugin) or no-store on the homepage are MEDIUM.
- WP debug exposure A readable /wp-content/debug.log is CRITICAL. PHP error markers in the HTML (Notice:, Fatal error) and stack traces are HIGH. Conservative: it never matches “warning”/“error” in prose.
- WP compromise indicators Conservative IOC baseline over the homepage HTML: contiguous base64 ≥500 chars inside an inline script (MEDIUM), inline eval( (HIGH), meta refresh to a third-party domain. Thresholds are high so GTM/analytics aren’t punished.
- Multi-CMS Drupal (exposed CHANGELOG, settings.php), Joomla! (XML manifest, /administrator/), Magento (/magento_version, default admin path). CMS-specific checks.
- Malware Scan Crawl of up to 10 pages. Detects obfuscated JS (eval/atob, Dean Edwards packer), hidden spam content, external iframes, forms with action hijacking, User-Agent cloaking. Cross-references URLs against URLhaus + OpenPhish (~300k entries, daily sync).
- API Surface Exposed OpenAPI/Swagger, enabled GraphQL introspection, field suggestions.
- GraphQL / JWT Exposed GraphQL Playground, JWTs in body/cookie with alg:none (CRITICAL), long expiry, sensitive claims.
- Cloud Storage Detects S3, GCS and Azure Blob buckets referenced in the HTML. Tests public listing (CRITICAL) or records as INFO if private. It extends into S3 bucket enumeration (Pro+): a 20-suffix wordlist over the eTLD+1 (-backup, -prod, -uploads…) testing public listing in parallel, deduped against buckets already referenced in the HTML.
- CORS Wildcard with credentials, Origin reflection, null origin.
- HTTP methods TRACE enabled, sensitive verbs (PUT/DELETE without authentication).
- Active XST confirmation ACTIVE check behind the authorization gate: sends TRACE/TRACK with a unique token in a header and confirms Cross-Site Tracing when the server echoes the token back (MEDIUM — proof, not just "declared"). Non-destructive, narrow scope.
- Open redirect next, redirect, return parameters — confirmed by the parsed host in the response.
- Robots / Sitemap Sensitive paths declared (admin, internal, backup) in /robots.txt and /sitemap.xml.
- WAF Detection WAF/CDN fingerprint via headers, cookies and body (Cloudflare, Sucuri, Imperva, Akamai, CloudFront, Fastly, Vercel, Azure, F5, Wordfence, ModSecurity). Shows the scanner IP for allowlisting.
- Directory Discovery Parallel sweep of ~40 common paths (admin panels, phpMyAdmin, debug panels — Horizon, Telescope, Pulse, Debugbar, Clockwork —, backups, uploads, config, logs). An OPEN debug panel (HTTP 200) escalates to CRITICAL: queue dashboards render queued job payloads — channel tokens, webhooks, recipient PII; present but protected (403) stays HIGH. Soft-404 detection via canary. Gated by authorization.
- Tech Disclosure Software versions exposed in HTTP headers (Server, X-Powered-By, X-AspNet-Version) and meta generator, enabling targeting by a specific CVE.
- Host Header Injection Reflection of X-Forwarded-Host and X-Original-Host in the body or Location. Detects the password-reset poisoning and cache-poisoning vector (HIGH).
- Internal Network Leak Private RFC 1918 IPs (10.x, 172.16–31.x, 192.168.x, 127.x) and internal hostnames (.internal, .corp, .lan) in HTTP headers — reveals infra topology to the attacker.
- Form Password Forms with input[type=password] submitted over HTTP (CRITICAL — cleartext password) or to an external domain (HIGH — credential harvesting).
- Caching Security Responses with Set-Cookie without Cache-Control: no-store/private (MEDIUM) and evidence of a session served from a shared cache via the Age header (HIGH). RFC 7234.
- Security.txt Quality Validates security.txt per RFC 9116: mandatory Contact (HIGH), mandatory Expires (MEDIUM), expired record (MEDIUM) or valid for more than 1 year (LOW).
- Observed rate limiting Reports whether the target throttled requests during the audit — without firing a single request of its own. It only reads the traffic the other probes already produced, so it has neither an authorization nor a plan gate.
- Modern stack Fingerprints Next.js, Astro, SvelteKit, Remix and Nuxt from characteristic headers and paths. Feeds detected_stack and unlocks the next three probes.
- Exposed source maps A source map published in production reveals the original code with variable and function names. MEDIUM on a 200; HIGH when the body carries sourcesContent (full source, not just names). At most 6 paths per run.
- Exposed .env .env served from the public root — a common mistake with a misconfigured next export. CRITICAL with a real secret fingerprint (DATABASE_URL, AWS_ACCESS_KEY_ID, STRIPE_, SUPABASE_); HIGH on the generic KEY=value pattern.
- Unauthenticated /api routes An /api/* endpoint returning JSON with no authentication. CRITICAL with PII or an apparent token; MEDIUM with an array of objects holding sequential IDs. Conservative: 1 request per path, 6 max.
- Nuclei Community CVE templates, running asynchronously outside the PHP batch (RunNucleiProbeJob). It is the only wrapped probe in this layer.
Layer 3 Identity & domain 6 probes Who answers for this domain, how it receives email, and protection against hijacking.
- Email (presence) SPF (with lookup budget RFC 7208 §4.6.4), common DKIM selectors, DMARC, absence of records.
- Email (strength) Policy quality analysis: SPF +all/?all (HIGH), SPF ~all without DMARC enforcement (MEDIUM), DMARC p=none (HIGH), DMARC pct<100 (LOW). Goes beyond presence — evaluates whether the policy actually protects.
- MTA-STS / TLS-RPT Secure SMTP transport policy (RFC 8461): publishes policy, file accessible, enforce mode. TLS reporting (RFC 8460) configured.
- Whois (RDAP) Domain expiry, clientHold status, pendingDelete.
- Domain Lock Checks via RDAP whether the domain has a registrar lock: clientTransferProhibited (MEDIUM if absent) and clientDeleteProhibited (LOW if absent). Prevents domain hijacking.
- Sub-domains Passive discovery via Certificate Transparency (crt.sh) + subdomain takeover check on 16 services (GitHub Pages, Heroku, Fastly, etc.).
Layer 4 Compliance 1 probe · 7 detectors The Brazilian layer — LGPD observable from outside, based on the articles that hit the typical site. Findings feed the compliance map (LGPD/ISO 27001/PCI-DSS).
- Third-party trackers GA4, GTM, Meta Pixel, Hotjar, Clarity, TikTok, LinkedIn, Mixpanel, Amplitude, Segment, FullStory and more — 24 hosts + 11 inline patterns (gtag, fbq, dataLayer). Detects a tracker loading BEFORE the banner even when there’s no HTTP cookie. HIGH if no banner. Ref art. 7º, I.
- Banner & dark pattern Detects the banner presence (CookieYes, OneTrust, Cookiebot, Iubenda, Klaro, Didomi, Usercentrics, Termly, Osano and custom) and checks whether there’s a visible "Reject"/"Necessary only" option. An "accept or nothing" banner is a consent defect (ANPD Cookie Guide, art. 8º §4º).
- Policy & DPO Detects a link/mention of the privacy policy and DPO contact via DOM parsing (XPath on <a href> + visible text). Scans a dedicated page (/politica-de-privacidade, /privacidade) collected by the crawler even when the home doesn’t cite it. Refs art. 9º + art. 41.
- Form without notice POST forms collecting email, CPF, phone, name or password without a checkbox or visible link to the privacy policy nearby — missing informed consent (art. 8º, §1º). DOM parsing with heuristic fallback on form siblings.
- PII in URL CPF, email, phone or RG passing via querystring in page links. Value masked before persisting as evidence. Leaks in server logs, browser history and Referer to third parties — a classic security risk (art. 46).
- Intl. transfer Cross-references a foreign hosting fingerprint (Cloudflare, AWS CloudFront, Vercel, Azure, Fastly, Akamai, Fly.io, Netlify, Render, Railway — 17 headers + 7 tokens in Server/Via) with a mention of "international transfer"/"standard contractual clauses" in the text. No disclosure = LOW (art. 33).
- Tracking cookies Classic tracking cookies (_ga, _gid, _fbp, hjid, _hjSessionUser, etc.) set on first visit with no banner detected — HIGH (art. 7º, I).
Layer 5 People 2 probes (opt-in) Human vector — the target’s domain and emails in public data breaches. Now continuous: daily watch + dedicated panel + alert, not just during the audit.
- Credential leak Opt-in per target. Cross-references the registrable domain (+ extra domains) against the Have I Been Pwned catalog synced locally (daily sync). Emits an aggregate finding with breach count, compromised accounts and the most recent date; severity by recency and sensitivity of exposed data. 100% passive — doesn’t touch the target.
- Email leaks Collects mailto: and fallbacks (contact@, admin@, security@) and cross-references via h8mail against public breach databases.
Layer 6 Source code & deploy 7 probes (opt-in) Opt-in (Agency+ plan) — 5 white-box probes with a temporary repo clone (SAST, secret scanning, Dockerfile, IaC, GitHub Actions), 1 that reads dependency lockfiles via the provider API (no clone) and 1 gray-box connector that reads the Vercel API.
- Repo dependencies composer.lock, package-lock.json, yarn.lock, requirements.txt, poetry.lock, go.mod, Gemfile.lock — GitHub/GitLab (subgroups)/Bitbucket. Optional PAT for private repos. Cross-referenced with OSV.dev + CVE/EPSS/KEV.
- SAST (Semgrep) Static analysis with rulesets detected by stack: PHP/Laravel, JavaScript/Express/React, Python/Django/Flask, Go, Ruby, Java + OWASP Top 10. Findings grouped into 15 buckets (SQLi, XSS, command injection, path traversal, mass assignment, weak crypto, etc.). CWE-78/89/94 automatically promoted to CRITICAL.
- Secret scanning Gitleaks scans the git history of the cloned branch — full when the repository fits the size cap, shallow when it does not —, and the finding states which of the two. Detects AWS/GCP/Azure keys (CRITICAL), GitHub PAT, Stripe/Twilio/SendGrid, PEM private keys, and ~150 other patterns. Value masked (prefix only) before persisting.
- Dockerfile (Hadolint) Dockerfile lint detecting insecure practices: persistent USER root (HIGH), ADD instead of COPY, unpinned versions in apt/apk/pip/npm, latest tag, missing HEALTHCHECK, shell without pipefail, apt cache not cleaned. 9 translated buckets.
- IaC (Trivy config) Misconfigurations in Terraform (.tf), Kubernetes manifests, CloudFormation, Helm charts, Ansible playbooks + CIS Docker benchmark. Severity straight from Trivy (CRITICAL/HIGH/MEDIUM/LOW), cap of 500 findings per run ordered by severity.
- GitHub Actions Custom parser for .github/workflows/*.yml: pull_request_target + checkout of the PR head (CRITICAL — classic RCE), permissions: write-all (MEDIUM), actions without a SHA pin (@branch HIGH, third-party @tag MEDIUM), secrets echoed in run (HIGH).
- Vercel (API) Connects to the official Vercel API with a per-target read-only token (encrypted). Audits the Node version (HIGH if EOL/no security support, MEDIUM if recent end of life), whether the latest production deploy broke — with the build error lines — and the failed-build rate in recent history. Doesn’t read environment variables or source code.
Layer 7 External exposure (OSINT) 3 probes (plan-gated) Leaks of your domain in public sources outside the perimeter — search engines, public repos, the Internet Archive, guessable cloud buckets. 100% passive, plan-gated.
- Google Dork (Pro+) Scans the Google index via Serper.dev across 11 categories: sensitive files indexed (.env, .sql, .bak, phpinfo, directory listing, credentials in URL) and mentions of the domain in public pastes (Pastebin, Gist, Postman, GitLab, Bitbucket, Docker Hub). Covers the classic case of "file removed from the server but still in the cache". Opt-out per category; 24h cache.
- Public Repo Leak (Business+) GitHub Code Search with 7 queries: .env files, DATABASE_URL, AWS access keys (AKIA), RSA private keys, Slack webhooks, wp-config.php + optional enumeration via org:{handle}. Catches company repos accidentally made public and employees committing secrets to personal accounts. Automatic masking of AWS/Slack/GitHub/Stripe in evidence snippets. Excludes the connected repo to avoid self-hits.
- Wayback Machine (Pro+) Internet Archive CDX API. Lists historical URLs of the domain pointing to sensitive files (18 extensions: .env, .sql, .pem, .config, .log, etc.) — even after removal from the server, the content remains accessible indefinitely via the Wayback cache. Grouped by extension into a single finding.
The probes in layers 1–4 run on every audit once the domain is authorized (3 of them — Ports, Directory Discovery and active XST confirmation — require an extra authorization gate for active probing). The opt-in probes (layers 5 and 6) need extra data: breach-monitoring toggle, authorization to collect emails, the repository URL for the white-box analyses, and a read-only Vercel token for the project audit. Layer 7 (OSINT) is 100% passive — it never touches the target, only scans public indexes — and is plan-gated: Pro+ unlocks Google dorks, Wayback and cloud bucket enumeration; Business+ adds scanning of public repositories leaking code.
Outputs
Detecting is not enough. It has to be actionable.
Executive PDF
A board summary and the technical detail in the same document, with the score, the diff and what to do. White-label on the Agency plan.
Evidence per finding
Every finding carries what was observed — header, response snippet, DNS record — so the team can check without redoing the test.
Diff between audits
What appeared, what disappeared and what remains since last week, with new findings highlighted.
Export and API
CSV, JSON and a read-only API. The history is yours, including on the way out.
Remediation task
A finding becomes a task with an owner and a deadline, and the workspace MTTR shows whether the queue moves.
Jira and CI/CD
An issue opened in your project and SARIF on GitHub Actions to fail the build when something critical shows up.
Recurrence
An audit every week, without you remembering.
Set it up once. Sentinela runs at the agreed time, compares against the previous audit and notifies the chosen channels while a critical or high finding is open — with the new ones highlighted.
From Pro up there is also the event trigger: a light probe notices new exposure — an open port, a dropped header, a critical vulnerability — and fires the deep audit in about 30 seconds, without waiting for the week to turn.
By profile
Same platform, different readings.
Leaked? You find out — without auditing.
Every day we cross your domains against the public leak catalogue. New exposure raises an alert the same day and lands in the Operations Center. Credenciais & Dados Expostos live in a single panel, 100% passive.
Dated documentary evidence.
Seven privacy detectors observable from the outside: third-party tracker before the banner, "accept or nothing", a form with no notice, personal data in a querystring, international transfer without disclosure. The compliance map correlates with LGPD, ISO 27001 and PCI-DSS.
Recurring billing with proof.
Audit every client site in one account. White-label PDF with your brand and an executive summary every month, showing the score climbing from C to A — a concrete argument at renewal time.
Transparency
Behind the authorization gate.
Before running any active probe against your domain, we require you to tick “I authorize the audit of this domain”. Without it, only the 100% passive probes run — DNS, WHOIS, CT logs. That protects you, protects us, and is aligned with security research best practice and with privacy law.
Comparison
Sentinela vs alternatives.
| Sentinela | Application scanner (DAST) | ASM platform | Infrastructure scanner | |
|---|---|---|---|---|
| Native Portuguese | yes | — | — | — |
| Payment in BRL with invoice | yes | — | — | — |
| Dedicated privacy probe | yes | — | — | — |
| Uptime in the same panel | yes | — | — | — |
| Financial risk in R$/year | yes | — | — | — |
| Automatic recurring audit | yes | yes | yes | yes |
Every product is strong at something — pick the one that fits your case. Comparison based on the public plans of the respective platforms in August 2026.
Is this a pentest?
No. It is automated, recurring external ASM: we observe what your domain exposes, without exploiting anything. It complements the human pentester — it does not replace one.
Will it take my site down?
No. The probes are rate limited and low impact. None does brute force or destructive testing, and the three active-probing ones require your approval on top of the domain authorization.
Why do I have to authorize the domain?
Because active auditing is only legitimate with permission from whoever controls the domain. It is one click, recorded with a timestamp, and it protects both sides.
Does the report count as privacy-law evidence?
It counts as evidence of continuous effort, dated and auditable — which is what the DPO needs to show. It is not a formal certification, and we do not pretend it is.
How is the A-to-F score calculated?
It is a technical 0-to-100 score, comparable across targets: each finding weighs by severity and by layer. Contextual risk — business criticality, known exploitation, cost in reais — lives on a parallel axis, so the score does not become an opinion.
Do I have to give access to my code?
Only if you want the two opt-in layers for code and deploy. Without them, 49 probes already run with no credentials at all. With them, the clone is temporary and discarded after the analysis.
How often should I audit?
Weekly covers most cases, because the surface changes with every deploy. If the site changes daily, use the event trigger: the deep audit runs when something actually changed.
Without real downtime, risk in reais is a guess.
Exposure in R$/year uses the downtime cost we measured on your site — not a market average. That is why both things live in the same panel.
See Uptime →Start today
See your security posture in a few minutes.
Authorize the domain, run the first audit and get the score with prioritized findings. No card to start.