The security dashboard for people who won't check ten repos by hand
One docker compose up -d, one browser tab. LazySentry watches every repository you care about for vulnerabilities, outdated packages and leaked secrets — self-hosted, so your code never leaves your infrastructure.
Step 1 of 4 — grab the two config files
60 seconds, and you'll know if it's for you
Three questions, answered for every finding
What is this? How bad is it? What do I do now? LazySentry answers all three without a click — for every repository, every time it scans.
Vulnerabilities
Every direct and transitive dependency checked against the OSV database, so you find out about a CVE before an attacker does.
Outdated packages
Installed vs. latest registry version, classified as patch, minor or major — so you know which upgrades are routine and which need a plan.
Leaked secrets
Working tree and full git history scanned with TruffleHog, including live verification of found credentials against the provider's API.
GitHub & GitLab, several accounts at once
Import from multiple GitHub or GitLab accounts — gitlab.com or self-hosted — side by side.
Findings tracked over time
Every vulnerability or secret is one record per project — see when it first appeared and when it was resolved.
Live scan status
Scan updates reach the browser via Server-Sent Events. No client-side polling, no stale spinners.
Hardened by default
The worker processes untrusted repository content and runs as non-root with every capability dropped.
Raw secrets never stored
Findings are reduced to a fingerprint and a masked preview. The plaintext never touches the database or logs.
No false green
"Nothing scanned" always looks different from "nothing found." A missing lockfile is a warning, not a clean bill of health.
One image, two processes, one SQLite volume
- No Redis, no external queue
- Jobs live in a SQLite table, polled by the worker. Zero operational overhead beyond the one container.
- Pinned scanner binaries
- osv-scanner and TruffleHog are baked into the image at exact versions; every scan records what produced it.
- Updates in real time
- Scan status reaches the browser via Server-Sent Events — no client-side polling, no stale state.
api
Fastify + React UI
worker
scan queue + scanner binaries
SQLite
shared volume
No git clone, no build step
Two files and one command pull the prebuilt image from GHCR. Open 127.0.0.1:3111 and you land in the setup wizard.
Grab the two config files
Copy the example environment
Generate an encryption key
Start it
Full walkthrough, including exactly which GitHub token permissions to grant, lives in docs/SETUP.md.
Actively shipping. Here's what's live and what's next.
This is a single-maintainer project under active development — issues and pull requests are welcome.
Shipped
- Dependency & CVE tracking
- Version auditing (patch / minor / major)
- Secret detection with live verification
- GitHub, GitLab & Gitea import, multiple accounts
- Notifications (Discord, Slack, webhooks) & scheduled scans
- Fleet-wide package view & trend charts
- Per-project detail view
- Multi-user accounts & audit log
- Docker Compose setup
Up next
- EPSS / CISA-KEV prioritization
- AI-assisted triage & upgrade hints
- SBOM export
Five minutes of setup. Every repo, watched.
Free, open source and MIT licensed. Self-host it next to the code it protects.