How vansh-quant/sentinalapi works
SentinelAPI lets users manage projects, upload OpenAPI specifications, and run isolated vulnerability scans against authorized sandbox targets. The workflow proceeds from authentication and spec ingestion through endpoint discovery, asynchronous scanning, persisted and sanitized findings, and dashboard/report or live-feed consumption. The README also documents attack-surface and timeline views. The graph reflects documented capabilities; sampled source confirms the API entry point, database, scan manager, and WebSocket broadcaster, while some route-to-service wiring is described only at a high level.
Main entry points: database.py Application Database · main.py FastAPI Application · scan_manager.py Async Scan Manager · app.js Dashboard & Reports
Components 19
User Interface
- Dashboard & Reports
frontend/app.js
Backend API
- FastAPI Application
backend/app/main.py - Authentication
backend/app/api/auth.py - Project Management
backend/app/api/projects.py - Scan API
backend/app/api/scans.py - Findings API
backend/app/api/findings.py
Scan Execution
- OpenAPI Parser
backend/app/services/openapi_parser.py - Async Scan Manager
backend/app/services/scan_manager.py - Scanner Client
backend/app/services/scanner_client.py - Scanner Engine
scanner/service.py - Vulnerable Sandbox
sandbox/app.py
Persistence
- Upload Storage
backend/app/services/storage.py - Application Database
backend/app/core/database.py
Results & Feeds
- Result Sanitizer
backend/app/services/security_sanitizer.py - Dashboard & Reports
backend/app/services/dashboard_service.py - Scan Timeline
backend/app/models/scan_event.py - Live Feed Manager
backend/app/services/ws_manager.py
Other components
- Security Engineer
- Optional Scanner Service
Connections 26
- Security Engineer → Dashboard & Reports: uses
- Dashboard & Reports → FastAPI Application: calls API
- Dashboard & Reports → Live Feed Manager: subscribes
- FastAPI Application → Authentication: routes auth
- FastAPI Application → Project Management: routes projects
- FastAPI Application → Scan API: routes scans
- FastAPI Application → Findings API: routes findings
- Authentication → Application Database: reads/writes users
- Project Management → Application Database: persists projects
- Scan API → Upload Storage: stores uploads
- Scan API → OpenAPI Parser: parses spec
- Scan API → Async Scan Manager: starts/cancels
- OpenAPI Parser → Application Database: stores endpoints
- Async Scan Manager → Application Database: reads/writes scan data
- Async Scan Manager → Scanner Client: executes scan
- Scanner Client → Scanner Engine: uses fallback
- Scanner Client → Optional Scanner Service: dispatches
- Scanner Engine → Vulnerable Sandbox: sends test requests
- Async Scan Manager → Result Sanitizer: sanitizes results
- Async Scan Manager → Live Feed Manager: broadcasts updates
- Live Feed Manager → Dashboard & Reports: streams events
- Findings API → Application Database: reads/writes findings
- Findings API → Result Sanitizer: sanitizes evidence
- Dashboard & Reports → Application Database: reads scan data
- Scan Timeline → Application Database: persists timeline
- Dashboard & Reports → Dashboard & Reports: requests metrics/reports