Home

SentinelGo

SentinelGo is a single, dependency-free Go agent that collects hardware inventory, security posture, encryption status and audit logs from Windows, macOS and Linux endpoints. It reports them to a Supabase backend. It runs as a native service (Windows Service, systemd, launchd) and updates itself from signed releases.

This wiki holds process and operational knowledge: how we work on the repo, keep it secure and ship it. Code-level documentation lives in the repository's docs/ folder, next to the code it describes, so it stays in sync with that code.

Wiki pages

Page	What it covers
Security & Code Scanning	Which scanners run, how alerts are triaged, workflow hardening rules, #nosec conventions, the PR auto-merge flow
Roadmap	What the platform (agent + backend) does today, everything delivered since May 2026, and what comes next: hardening, enrollment, compliance, enforcement, MDM
MDM Assessment	What MDM is, what it unlocks (especially on macOS), prerequisites, build-vs-adopt, discovery gate
DLP Assessment	What DLP covers, what we could build by tier, and why it is deferred

Repository documentation

Document	What it covers
Project overview	Architecture, package layout, runtime flow
System architecture	Components and how they interact
Main module	CLI, flag parsing, service entry point
Config module	Configuration schema and validation
OS info module	Cross-platform hardware metrics
Service module	Service lifecycle and auth
Updater module	Self-update flow
Audit logs architecture	Audit-log pipeline end to end
Agent commands guide	Remote task / command handling
Testing	How the test suite is organised
Installation	Per-OS install steps
SECURITY.md	Vulnerability reporting and security architecture
CONTRIBUTING.md	Dev workflow, commit style, PR checklist

Hard rules (from CLAUDE.md / CONTRIBUTING.md)

• No cgo, ever. Every build uses CGO_ENABLED=0. make check-no-cgo enforces this in the pre-release gate.
• Validate platform-specific code on every target with make verify-cross.
• Never hardcode Supabase credentials or API keys.
• Never edit release/ by hand. Use make release VERSION=vX.Y.Z.