Janitor Sentinel installs statistics

Janitor Sentinel is a zero-upload structural firewall for AI-generated PRs. The engine runs entirely on your GitHub Actions runner; source code never leaves your infrastructure. The Governor receives scores, not code. Each PR is evaluated against 23 languages using tree-sitter AST analysis, MinHash clone detection, and NCD entropy gates. Findings surface as GitHub Check Runs and inline SARIF annotations.

Capabilities

• Zero-Upload: Scan code locally on your runner. Only metadata reaches the cloud. • Structural Detection: 50+ AST antipatterns (gets/strcpy, open CIDR, innerHTML) across 23 languages. • AI Swarm Interception: MinHash LSH identifies structural clones across multiple authors. • Bot Defense: Calibrated NCD gates detect machine-generated boilerplate verbosity. • Zombie Deps: Scans manifests for previously removed dependencies resurfacing.

Benefits

• CISO Approved: Code never leaves your secure boundary. Governor is stateless. • Zero Noise: Math-based proof, no regex guessing. No false positives on bot accounts. • 8GB Law Performance: Scans 3.5M LOC in <33s on standard hardware.

Getting Started

Plan: Team Tier ($499/yr) at thejanitor.app. Marketplace listing is Free.

Permissions: Requires security_events: write for inline alerts.

- uses: janitor-security/the-janitor@main with: token: ${{ secrets.GITHUB_TOKEN }} installation_id: ${{ vars.JANITOR_INSTALLATION_ID }}

Example Findings

• security:unsafe_string_function — gets() detected (line 4). • security:compiled_payload — cryptominer URI detected (line 5). • architecture:zombie_dep — package 'log4j' resurfaced.

The Proof

Audited 33,000+ PRs across 22 enterprise repos (Kubernetes, NixOS, Godot).

Pricing

• Janitor CLI (Free): Core engine on your runner. Uncapped. • Team Tier ($499/yr): Sentinel governance, PQC CBOM bonds, and org-wide policy. Available directly at https://thejanitor.app.

Description from the GitHub Marketplace listing.