User submits a merchant website URL. Sentinel creates a scan job and begins autonomous analysis. Supports any HTTP/HTTPS ecommerce site.

A deep HTTP crawler explores the target site — extracting pages, forms, buttons, links, and API endpoints. It detects ecommerce capabilities: cart, checkout, promo codes, login, signup, refund flows, payment forms, loyalty systems, and more. Respects depth limits, rate limiting, and same-site boundaries.

From crawl data, Sentinel identifies attack-relevant ecommerce flows: rapid checkout paths, cart manipulation routes, refund request chains, account creation funnels, referral loops, and card testing surfaces.

Claude (via AWS Bedrock) analyzes the crawl data like an attacker — generating detailed vulnerability hypotheses. It identifies promo abuse, credential stuffing, cart manipulation, payment fraud, race conditions, missing friction, and dozens of other attack vectors specific to the target.

For each hypothesis, the LLM generates a precise Playwright browser automation test — with navigation steps, form interactions, assertions, and safety constraints. Each test is designed to prove whether the vulnerability is actually exploitable.

A headless Chromium browser executes each confirmation test against the live target. It navigates pages, fills forms, clicks buttons, and captures screenshots as evidence. Tests that fail are marked not reproduced; tests that succeed confirm the vulnerability exists.

Confirmed vulnerabilities become findings with severity ratings, evidence chains, and dual fix recommendations:

After the merchant applies a fix, Sentinel reruns the original confirmation test. If the attack now fails, the finding is marked VERIFIED FIXED. If it still succeeds, it remains STILL VULNERABLE. This closes the loop — proving the defense works.

Architecture

Tech Stack

Module Boundaries