Home · Security
Security SentinelMost scanners hand you five hundred findings and walk away. The reason nobody fixes them is not laziness: nothing says which ones can actually hurt you, and nothing ever confirms the fix worked.
Every paid plan includes Security Protection for 25 repositories, with more in blocks of 25 for $100 per month. During your trial, Sentinel protects up to 5 repositories — real scans, not a preview. Fix verification is included on every plan. Scale also includes compliance CSV export for your auditors.
Checks for leaked secrets, risky CI, infrastructure-as-code misconfiguration, and known-vulnerable dependency versions in changed lockfiles run on the lines each PR adds — on every PR, whatever your AI allowance. Risky CI includes Bitbucket Pipelines, GitLab CI, CircleCI and Jenkins pipelines that deploy with long-lived cloud keys from repository variables instead of OIDC. Placeholder and example secrets are never reported.
Repositories that changed are scanned incrementally every 4 hours. The deterministic detectors refresh weekly, and a deep whole-repository sweep runs monthly.
Every lockfile is checked against the OSV.dev vulnerability database (which aggregates GitHub Security Advisories, the NVD and ecosystem feeds) across npm, PyPI, Go, Maven, Cargo, RubyGems, Composer, NuGet and more. Each vulnerable package becomes a finding with its advisories, severity, the lowest fixed version, an owner and a due date. A pull request that introduces a vulnerable version is flagged on the line that adds it, and the merge gate can hold it. For high and critical findings, the AI checks whether your code actually uses the vulnerable package and ranks the finding up or down, never hiding it. OSV.dev receives only package names and versions, never your code.
On the Scale plan, export an evidence package for any period: pull request review coverage, merge gate decisions and overrides, security findings with time to fix, verified fixes and dependency vulnerabilities, mapped to the SOC 2, ISO 27001, PCI DSS and HIPAA controls they support, with a checksum manifest. Each control states what the evidence does not cover. NRD Sight provides evidence for your auditor's review; it does not determine compliance.
Upload a questionnaire (CAIQ or your customer's spreadsheet) and NRD Sight drafts answers from your own evidence, your uploaded policies and answers you approved before, each with its sources shown. An answer with no source is marked "Needs your input", never invented. You review and approve before anything is exported. Scale plan.
Runtimes, frameworks, and container base images past end of life are flagged using endoflife.date, which receives only the names and versions we look up — never your code.
Who fixed what, when, at which commit, and how — by hand, by re-check, by a push to the default branch, or by a reviewed claim — plus regressions and who still owns what is open, over any window. The record your auditor asks for.
A secret removed from the code but still in git history is folded into one rotate-credentials item per repository, as severe as its worst member. It closes when the owner attests the credentials were rotated or revoked, and reopens if a credential shows up in the code again.
A plain-English security brief for leaders: whether you are in a defensible position, and why.
Sentinel doesn't scan container images or operating-system packages, doesn't check licenses, and doesn't detect malware beyond the advisories OSV.dev publishes. Dependencies without a pinned version in a lockfile aren't checked.
We ask for a lot of trust — read access to your source. Here is exactly how we honor it.
Analysis runs on Amazon Bedrock inside our AWS environment. Diffs are stored encrypted at rest in S3, every connection over the internet uses TLS, and your code is never used to train any model.
The GitHub App asks for read access to repository contents, metadata and pull requests on the repositories you enable, plus read access to organization membership (to map commit authors to people) and branch protection settings (to confirm the “NRD Sight review” check is required). It can write pull request comments (GitHub’s issues scope, which covers PR conversation comments), the “NRD Sight review” check, and merge-queue status. Bitbucket Cloud: read contents, pull requests and metadata; write review comments, a build status and PR tasks. Contents are read-only: never commits, never branches. Uninstalling or revoking access cuts it off instantly.
Every row of your data is isolated with Postgres row-level security enforced at the database layer — not just application filters.
Every score traces to a stored model response and a quoted diff. When a number surprises you, click through to the exact evidence.
Runs entirely on AWS infrastructure holding SOC 2, ISO 27001, and PCI DSS attestations. Payments are handled by Stripe — card data never touches our servers.
Hard monthly AI-spend caps you configure. Export or delete your data on request. A standard Data Processing Agreement is available to every customer: read it at /dpa and accept it on the Billing page in a minute.
NRD Sight runs only on AWS (us-west-2), which holds SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS attestations. Payments run on Stripe, a PCI DSS Level 1 service provider.
TLS 1.2+ on every connection over the internet; inside our private AWS network, traffic never leaves AWS. Databases and secrets are encrypted at rest with AWS KMS, and object storage with AES-256. Customer data stays in the United States, is never used to train models, and is deleted within 30 days of a written request.
Amazon Web Services (hosting, storage, AI analysis via Amazon Bedrock, email), Stripe (billing), and Better Stack (operational alerting, no customer code), endoflife.date (receives only runtime and package names and versions for end-of-life checks, never code), OSV.dev (receives only package names and versions for vulnerability checks, never code), plus the sign-in provider, code hosts, and work trackers you choose to connect. The current list is in our privacy policy.
Every production change goes through a pull request with required automated tests before it deploys. Tenant isolation is enforced by Postgres row-level security, and administrative actions are recorded in an audit log.
Our Data Processing Agreement is published for everyone. Our responses to the CSA CAIQ v4 security questionnaire and an architecture overview are available on request. Email support@nrdsight.com.
If we become aware of a breach affecting your data, we notify you without undue delay with what we know, what we are doing, and what we recommend.
Every change is checked for leaked secrets and risky code before it ships, vulnerable dependencies get automatic fix pull requests, and each release records a software bill of materials. Amazon GuardDuty, Security Hub and AWS Config watch our production account and alert on-call to high-severity threats and configuration drift.
We disclose customer data to a government or law-enforcement authority only when legally compelled by valid legal process, such as a subpoena, court order or warrant. We check each request, challenge any that is overbroad or unlawful, and disclose only the minimum it requires. Unless the law forbids it, we tell the affected customer first so they can seek to limit it.
Security is a split: AWS runs the data centers, we run NRD Sight, and you decide who gets in and what we can read. See who handles what.
Email support@nrdsight.com with "Security report" in the subject, the affected URL or component, and steps to reproduce. We acknowledge reports within three business days and keep you updated until the issue is resolved. Our security.txt has the same details.