sentry
Sentry CLI - A command-line interface for using Sentry built by robots and humans for robots and humans
72%
Total Score
caution
Active, well-backed CLI with strong documentation, but workflow permissions and a license mismatch require caution.
Health Score Breakdown
All 14 workflows were analyzed, but deploy.yml combines an untrusted checkout with workflow-level write permissions, and release.yml has a high-confidence blanket GitHub App permission finding. The audit also reports 26 of 91 action references unpinned; low-confidence cache and environment findings are hygiene concerns rather than standalone severe evidence.
No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent despite the package's otherwise strong project evidence.
The artifact contains an Apache-2.0 license file, while the manifest declares FSL-1.1-Apache-2.0; that mismatch creates a real licensing clarification concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10740 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. sentry is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.2.0 - 0.29.1. | 0.2.0 - 0.29.1 | Medium |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 15 years ago
- Unpacked Size
- 15.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.