1. The moment: when the AI writes faster than you can review
The moment always arrives the same way. You ask your AI "build me the login for my app," and in thirty seconds you have working code. You test it, you get in, it works. You move on to the next feature. And the next. The AI produces at a speed you, as a human, can't audit line by line. That's the exact moment the silent risk shows up.
Because the AI doesn't write like a suspicious auditor. It writes in what we call "builder mode": optimistic, imagining a single happy path, focused on "making it work." And in that mode it's physically incapable of seeing its own bugs — the same way you can't tickle yourself. The code runs, sure. But "runs" and "is secure" are two different things.
2. The pain: the bugs the AI can't see are the most expensive ones
The pain is real and honest — it's not an apocalypse, it's an accident that costs you dearly. These are the classic failures the AI leaves behind without meaning to, over and over:
- A secret (an API key, a password) written straight into the code and pushed to git — where it stays forever, even if you delete it later.
- A database query that forgets to filter by user → one customer can see another's data. The most expensive failure in any app with multiple users.
- An endpoint with no access protection: anyone with the URL gets in.
- A button that works with the mouse but is invisible to anyone browsing with a keyboard or screen reader (an accessibility failure, and sometimes a legal one).
- Personal data (emails, phone numbers) accidentally written into the logs.
What hurts isn't the bug itself: it's when you find out. You find out when a user complains, when someone leaks the data, when a fine arrives. By then it's already in production. The cost of a bug grows with how long it takes to discover — and the ones the AI can't see are exactly the ones that take longest to surface.
3. The habit: reviewing is NOT a one-off, it's every time the AI touches code
Here's the key that changes behavior, not just knowledge: Sentinel isn't something you use once and you're done. It's a habit. Every time your AI writes or changes important code, you ask Sentinel to review it before you call it good. Like putting on your seatbelt: you don't do it "when you remember," you do it always, automatically.
The moments when you should ALWAYS run Sentinel:
- Before you push your app to production (before the world sees it) → "is this secure?".
- When the AI touched something sensitive: login, payments, database, user data.
- When reviewing a change before accepting it (a PR, a new branch).
- Every so often, a general sweep — because what was secure yesterday could have broken with a change today.
4. What it reviews, exactly: 18 fronts
Sentinel scans across 18 dimensions, split into two big groups. You don't have to understand them all — but seeing them gives you a sense of what it does for you:
8 for classic security: secrets in the code, unprotected endpoints, queries that skip the per-user filter, database configurations that get painfully slow at scale, misconfigured security headers, personal data in logs, unvalidated inputs, and dependencies with known vulnerabilities.
10 "builder-mode blind spots": the recurring bugs the AI makes over and over while building interfaces and logic — keyboard shortcuts that steal Enter from the chat, buttons invisible to the keyboard, subtle memory leaks, duplicate identifiers, errors that get swallowed silently. This second group is the secret ingredient: it comes from a quality protocol refined over many rounds of real auditing, not from a generic list off the internet.
5. How to install it: one command
Sentinel is a skill for Claude Code (the AI assistant that works in your terminal or editor). It installs with one command and becomes available across all your projects. If you use Claude Code, this is all you type:
/plugin marketplace add MentexDev/neuralos-sentinel /plugin install neuralos-sentinel@neuralos-sentinel
Using another assistant (Cursor, Codex, Gemini CLI)? Sentinel follows the open skills standard, so it works there too with npx skills add MentexDev/neuralos-sentinel. Once installed, you don't invoke it with some weird command: you just talk to your AI normally.
6. The ready-to-copy prompt
So you don't have to figure out what to say, here's the complete, end-to-end prompt. Paste it into your agent (with Sentinel already installed), fill in the [brackets], and let the guardian do its job:
I want you to scan my code with the neuralos-sentinel skill, in read-only mode (don't change anything without my OK). Target to review: [the whole project / this folder / this file / the last change you made] Stack / technology: [e.g. Next.js + PostgreSQL database, or "not sure, look at the code"] Context: [e.g. "it's an app with multiple users/customers, so the data must NOT mix" · "it has login and payments" · whatever you know] Follow the Sentinel procedure: scan the 18 dimensions, VERIFY each finding (discard false positives), and give me a report ranked by severity. For every real problem: tell me in plain language what it is, what file it's in, why it matters, the proposed fix, and the test that locks it down. At the end, a "what I checked and discarded" section so I can trust you didn't invent alarms. Don't apply any changes yet: show me the report first and I'll decide what to fix.
7. The easy path: who does what
Since Sentinel lives inside your code agent, it helps to be clear on what happens in the chat and what you do. It's simpler than it looks:
- Read all your code and scan it across the 18 fronts.
- Verify each finding so it doesn't hand you false alarms.
- Write you a clear report, with the fix and the test for every real problem.
- Approve which fixes you want it to apply (Sentinel is read-only: it touches nothing without your permission).
- Actually rotate a secret that was exposed (that's done in the provider's dashboard, on the web).
- Decide whether a finding applies to your case or not (you know your business).
8. The repository (free, MIT, give it a star)
Sentinel is open source and free forever. It lives here — go in, take a look, install it, and if it catches a bug for you, leave it a star so more people can find it:
The security guardian for your AI-written code. Hunts the bug across 18 dimensions (security + builder-mode) and brings you the fix with its regression test. Read-only by default.