Lazarus Sentinel is a defensive, read-only analysis tool. It currently analyses only the fixed synthetic fixture fixture:fastapi-demo.

Report privately through GitHub security advisories. Do not open a public issue and do not include working exploit payloads or real secrets. Expect an acknowledgement within a few days; this is a volunteer project without an SLA.

• Path traversal, symlink or reparse-point escape in intake and bundle handling.
• Secrets reaching the frontend bundle, logs, reports or explanation sidecars.
• Injection or XSS in generated Markdown/JSON reports or the viewer.
• Bypass of the explanation budget or provider gates.

• Findings produced for the synthetic fixture: they are intentional test data.
• Analysing third-party systems. Only analyse repositories you own or are authorised to assess.