Paste text or drop files and SENTINEL finds what should not be in them: cloud and API keys, private key blocks, tokens, passwords sitting in config, connection strings with credentials, card numbers that pass the Luhn check, and identifiers like SINs and SSNs. Each finding shows its line and a masked preview; a cleaned copy replaces every one. Runs in this tab. Included in the Sovereign Pass.
Text files of any kind (.txt, .md, .json, .env, .yml, .csv, .log, source code) and Office documents (.docx, .xlsx, .pptx, read from the XML inside). Up to 25 MB each.
The cleaned copy replaces each finding with a marker such as [REDACTED AWS_KEY]. For pasted text it replaces the text box; for a file it downloads as name.cleaned.ext. Office documents are scanned but not rewritten; fix those in the application that made them.
It matches patterns and checks checksums. Known key formats (AWS, GitHub, Stripe, Google, Slack, OpenAI and others), private key blocks, JWTs, auth headers, credentials inside connection strings, and passwords or secrets assigned in config. Card numbers, IBANs and SINs are only reported when their checksum passes, so a phone number does not become a card.
It cannot find a secret that looks ordinary. A password that is a real word, an internal project name, a client's address: none of these have a pattern. SENTINEL catches the machine-shaped secrets. For names and personal details, use ALIAS.
No finding is not the same as clean. Treat the result as a first pass before something leaves your hands, not as a certificate.
A finding is not always a leak. A test key, a sample in documentation, or a placeholder can match. The masked preview and the line context are there so you can decide quickly.
Nothing leaves this tab. The scan runs in browser memory. Findings are shown masked, and the full values are never written anywhere by this page.