Quickstart

This page takes you from the email confirming your trial through to a prioritised backlog, and then optionally to a gate running in your pipeline. Allow about twenty minutes for steps 1 to 6. Steps 7 onwards can wait for another day.

Before you start. You need an authenticator app on your phone, such as 1Password, Authy, Google Authenticator or Microsoft Authenticator. Multi-factor authentication is required on every account and cannot be skipped.

1. Request a trial

Complete the form on the homepage. Trials run for 30 days.

Requests are handled by a person rather than an automated signup. Someone reads your request, creates your tenant, and replies to you directly. This is deliberate for early customers: it means your first scan is set up correctly rather than approximately.

2. Receive your account

You will receive an email confirming that your tenant exists, naming the email address your account is registered against.

You will not be sent a password, and nobody at Kademos Labs can tell you one. Accounts are created with a random secret that is discarded immediately, so no member of staff is ever able to produce your password. You set your own in the next step.

3. Set your password

Go to app.sinterly.com.
Select Forgot your password?
Enter the email address named in your welcome email.
Follow the link in the email that arrives and choose a password.

Passwords must be at least 12 characters and contain an uppercase letter, a lowercase letter, a number and a symbol. If a password is rejected, the message tells you which specific rule it failed rather than repeating the whole policy.

4. Set up multi-factor authentication

Your first successful sign-in takes you straight to multi-factor setup. Scan the QR code with your authenticator app and enter the six-digit code to confirm.

Save your authenticator entry somewhere you will not lose it. If you lose access to your second factor, contact support through the in-app help menu from any signed-in session, or reply to your welcome email. There is no self-service bypass, because a self-service bypass is not a second factor.

5. Set your first target tier

A target is an application or system you are tracking. Each one carries a business-context tier from A to D, and that tier feeds both the priority score and the CI gate. Your tenant is provisioned with one target, defaulted to tier C.

Open Targets and set the tier honestly:

Tier	Means
A	Public-facing and revenue-generating
B	Public-facing, limited revenue impact
C	Internal, some sensitive data
D	Internal, no public surface, test or mock data

This is the single highest-value thing you can do in your first session. Almost every number in the product changes with it.

6. Upload your first scan

Open Upload in the sidebar and drag in a SARIF, CSV or OTM file up to 25 MB.

Sinterly previews the file first: how many findings it contains, the severity breakdown, and the first few titles. Nothing is written until you confirm. If the file cannot be read, you are told the actual reason.

No scanner output to hand? Either of these produces real SARIF in under a minute:

semgrep --config p/owasp-top-ten <repo> --sarif > results.sarif
trivy fs <repo> --format sarif --output results.sarif

After you confirm, the pipeline deduplicates, enriches and scores. A typical scan completes in a few minutes. The run report tells you what was created, updated and merged.

7. Read your backlog

Open Findings. Your backlog is in priority order. Select any finding to see the five score components, the evidence behind the exploitability verdict, the suggested fix, and the estimated effort.

If a score looks wrong, that is useful information rather than a problem. Check the tier on the target first, then read Priority scoring to see which component is driving it.

8. Connect a scanner (optional)

Uploads are fine indefinitely, but a connector keeps findings current without anyone remembering to export a file. See Integrations. Switching from uploads to a connector does not create duplicates, because finding identity does not depend on how the finding arrived.

9. Connect Jira (optional)

See Jira and ticketing. Findings become tickets structured for the person who has to read them, and status changes flow back through a confirmation queue rather than silently.

10. Turn on the CI gate (optional)

Your tenant already has a gate policy, and it starts in advisory mode, which reports what it would block and never fails a build. You can wire it into your pipeline today with nothing at risk, watch it for a few weeks, and only then decide whether to make it blocking. See The CI gate.

What good looks like after a week

Every target has an honest tier.
At least one scanner is connected, or a scheduled upload habit exists.
Your top twenty findings have been looked at, and the ones that are not real have been marked as such with a reason.
The gate is running in advisory mode and you have seen what it would have stopped.