Syntinel
Reviews pull requests like an attacker, then proves serious findings with an exploit test in a sandbox.
- What
- AI code-security product
- Industry
- Products
- Year
- 2026
- Built with
- Python, Typer, Groq, Semgrep, Docker, pytest, GitHub App
The problem
AI code reviewers flag plenty of issues but rarely show evidence, so developers learn to ignore them. Pattern-matching scanners are reproducible but miss logic and authorisation bugs.
The gap was proof. If a finding comes with a test that fails while the bug exists and passes once it is fixed, a reviewer can verify it in seconds.
What we built
An open-source CLI and a hosted GitHub App that share one review engine. It combines an attacker-minded LLM pass with deterministic Semgrep rules, then generates a pytest exploit for each high or critical finding and runs it in a locked-down Docker container. Critical findings block the merge.
What it proved
On a seeded benchmark app it found 5 of 5 seeded vulnerabilities with 0 false positives on the clean files, across 3 of 3 runs. With verification on, 4 of the 5 classes were confirmed by a generated exploit test every run.
The benchmark is small: it shows the pipeline finds each seeded class and stays quiet on correct code, not that it catches everything in a real codebase.
