CodeSentinel is a GitHub-grounded portfolio registry and verification application. It combines a React/Vite frontend with a Node/Express server and verification-oriented project, security, audit-log, and portfolio views.
- React 19
- TypeScript 5.8
- Vite 6
- Node.js / Express 4
- esbuild
- Tailwind CSS 4
- Google GenAI integration
The exact dependency versions and scripts are defined in package.json. This README does not replace the lockfile or dependency manifest.
- Portfolio/project registry
- GitHub-grounded project information
- Verification and audit-log views
- Security-layer dashboard
- Project detail and search views
- Authentication-related UI
- Server-side API integration
- Environment configuration through
.env.example
Install dependencies using the repository's package manager and lockfile, then run:
npm run dev
Production build:
npm run build
npm start
TypeScript check:
npm run lint
The initial registry contains seed records marked pending verification. They are not proof that a repository, deployment, feature, metric, or CI run exists. The in-code repository fixtures are synthetic test data; their invented names, stars, issue counts, timestamps, deployment details, and capability descriptions must never be presented as live GitHub evidence. Only data retrieved from the actual GitHub repository and checks run against the relevant commit may be shown as verified.
CodeSentinel should distinguish clearly between:
- information retrieved from GitHub;
- information verified by an executable check;
- information supplied by a project registry;
- information generated or summarized by AI.
An AI-generated statement must not be presented as independently verified evidence.
Security correction: repository code contains no committed demo passwords. Local demo accounts must be injected through CODE_SENTINEL_DEMO_USERS_JSON; production requires an explicit SESSION_SECRET. Self-registration creates a guest account unless an authenticated lead engineer provisions another role.
See SECURITY.md.
Security and repository-governance configuration is also documented in docs/REPOSITORY-GOVERNANCE.md.
Existing functionality, historical components, and legacy material are retained unless there is a demonstrated technical reason to change or remove them. Changes should be additive or narrowly scoped whenever possible.
This repository is an active development project. Build, test, security, and verification claims should be based on the current repository state and CI results rather than inferred from documentation alone.