CodeSentinel: Your shipped app leaked all its keys

Scan mobile apps and web bundles for hardcoded secrets before release or in CI

Problem

A developer found that an offshore team hardcoded their Stripe master key and AWS access keys directly into an Android APK, extractable by anyone who downloads it. This is common in small teams and outsourced projects, but standard code review rarely catches build artifacts.

Solution

A lightweight CLI or CI plugin that scans build artifacts (APK, IPA, JS bundle, Docker image) for hardcoded secrets, API tokens, and sensitive configs, producing actionable reports and optional build blocking. Built-in pattern library minimizes false positives.

Users

Clients of outsourcing projects, small SaaS teams, indie developers

MVP

Scan APKs and JS bundles for secrets; built-in pattern matching for Stripe, AWS, GCP, OpenAI, and other common formats; output Markdown/JSON reports; provide GitHub Action and local CLI modes; one-click remediation guidance.

Revenue

Free local CLI; subscription for CI integration and auto-blocking; enterprise plan with private rule sets and audit logs.

Why now

Outsourced and AI-generated code is surging, raising secret-leak risks, while existing SAST tools poorly cover packaged artifacts.