Existing security scanners for CI/CD are mostly passive. They generate reports that developers often ignore. I built Sentinel Core to change that.

It is a deterministic security engine that acts as a hard-fail gate. If a security invariant is violated, the build is blocked. Period.

Key Features:

    Deterministic Enforcement: No more "warnings." It blocks unpinned Actions (CWE-1104), secret leaks, and insecure IaC.

    Zero-Telemetry: Built for high-security perimeters. Your logic and code never leave your environment.

    Performance: Written to be fast and lightweight, providing instant feedback via GitHub Job Summaries.

I'm looking for technical feedback on the enforcement logic and performance.

Test the Stand (try to bypass the gate):

https://github.com/DataWizual-Labs/the-stand.git