Web UI

Web UI

Sentinel includes a browser-based triage dashboard for reviewing and acting on findings.

Setup

pip install sentinel[web]
sentinel serve /path/to/repo

Opens automatically at http://127.0.0.1:8888. Use --no-open for headless mode.

Features

Run dashboard

• Severity stat cards (critical / high / medium / low)
• Findings grouped by severity
• Filter by severity, status, and detector
• Click any finding for full details

Bulk triage

• Checkboxes on findings with per-severity "select all" toggle
• Sticky action bar for batch approve or suppress
• Efficient workflow for processing many findings at once

Finding detail

• Full metadata: detector, category, severity, confidence, fingerprint
• Evidence items with code snippets and line numbers
• Inline approve/suppress with optional reason
• User notes and annotations
• Recurrence data (first seen, occurrence count)

GitHub Issues page

• View approved findings ready for issue creation
• Create GitHub issues or dry-run
• Config status indicator (token, owner, repo)

Scan page

• Form-based scan with repo path, model override, embedding model
• Skip-judge and incremental toggles
• Progress reporting

Evaluation page

• Run detectors against ground-truth for precision/recall measurement
• Results history with trend visualization

Settings page

• Active configuration display
• sentinel.toml status
• GitHub env var status

Run history

• All past scan runs with finding counts
• Scope badges (full / incremental / targeted)

Run comparison

• Select two runs to compare
• See new, resolved, and persistent findings

Eval trend chart

• Server-side SVG chart
• Precision and recall trends over time

Configuration

sentinel serve /repo --host 0.0.0.0 --port 9000  # custom bind
sentinel serve /repo --db /path/to/custom.db       # custom database
sentinel serve /repo --no-open                      # don't open browser

Security

• CSRF protection via HMAC-signed tokens (SameSite=Strict cookies)
• Scan paths validated against configurable allowed_scan_roots
• Path traversal prevention via Path.resolve()
• Binds to 127.0.0.1 by default (localhost only)

Theme

"Night Watch" dark-first theme with light mode toggle. System font stack — no external font dependencies.