Roadmap

Published so you can plan around it. Anything not yet shipped may change.

Shipped

Scanner engine: SAST, SCA, secrets, IaC, container, DAST, API security, runtime, CSPM, KSPM, compliance and adversary simulation, in one engine with a shared finding model.

Interfaces: the sentrasec CLI, the MCP server, the REST API and the web console.

Deployment: SaaS, connected self-hosted and air-gapped, from one platform.

Knowledge graph: rules, CVEs, CWEs, OWASP categories, packages, fixes and relationships, with graph-derived explanations.

Integrations: GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, CircleCI, Jira, Slack, Teams and SIEM export.

In progress

Expanded language coverage for semantic SAST. Full AST analysis currently covers a subset of supported languages; the rest fall back to structural analysis. Closing that gap is the largest active workstream.

Attack path visualisation. Chain synthesis works today; presenting chains as navigable paths in the console is being built.

Fix proposal quality. Tier-3 proposals: multi-file changes with test implications, are in active development.

Planned

Policy as code. Version-controlled policy definitions with review workflows, rather than console configuration.

Richer runtime correlation. Using observed workload behaviour to qualify static findings by whether the vulnerable path is actually executed.

Additional compliance frameworks. Beyond SOC 2, PCI DSS, HIPAA and ISO 27001.

Snapshot delta transfers. Incremental knowledge snapshots for air-gapped deployments, to reduce transfer size between updates.

Under consideration

These are being evaluated. Interest from users is a genuine input:

• IDE extensions with inline findings outside the MCP path.
• Multi-repository dependency graph analysis across an organisation.
• Custom rule authoring with a local testing workflow.

Feedback

The engine is open source: GitHub issues is the right place for defects and specific proposals. Discord works better for open-ended discussion about where this should go.