ArcSentinel is a sealed, consent-first OSINT and diagnostics workspace. Map your perimeter, audit your TLS, watch your DNS, and seal what matters in a vault only you can open.
// 01 capabilities
Modules ship with hard guardrails: consent gating, SSRF protection, private-IP refusal, rate-limiting, and structured output.
DNS, TLS, headers, subdomain mapping, ASN lookups. Triple-gated by consent.
Every scan ships with a sealed consent record. UI, API, and worker re-verify.
AES-GCM in the browser. Argon2id keys at rest. Even we cannot read your notes.
Watch your fleet pulse on a 3D sentinel orb. Pings, arcs, scan rings.
Mint scoped keys. Rotate on tap. Embed scans into your own pipelines.
Every action is logged. Filter by case, scan, target, or user. Exportable.
// 02 workflow
Add a target, attest you own it, paste evidence. We refuse to scan otherwise.
Pick modules. Tune depth. Sign the consent gate. Watch it run live.
Findings stream into your case file. Tag, annotate, seal to vault.
Export to PDF or JSON. Open a remediation ticket. Re-scan on a cadence.
// 03 security model
Outbound requests refuse RFC1918, link-local, and loopback ranges. CIDR-aware.
API keys are hashed with Argon2id. Memory-hard, side-channel resistant.
Vault entries are sealed in the browser. Server only sees ciphertext.
Edge proxy enforces strict transport, content security, and frame denial.
Upstash-backed token-bucket on every API surface. No back doors.
UI, API, and worker independently re-verify the consent record on every scan.
// 04 embed
Embed a sealed sentinel widget in your status page, internal wiki, or README. Updates over a signed channel. No tracking.
<iframe src="https://arcsentinel.app/embed/status/yourcase" loading="lazy" width="100%" height="160" style="border:0;border-radius:6px" ></iframe>