Shield v0.4.0

Free, MIT-licensed application security CLI. Rules are embedded in the binary — run it locally, offline.

What's new in v0.4.0

One-command CI onboarding — shield ci init run once inside your repo: mints a dedicated CI token, writes a hardened GitHub Actions workflow (pinned binary + checksum verification, full-history secrets scan, SARIF, gate report), and stores the secret via the gh CLI when available. No IDs to copy — the project is created from your repo name on the first scan.

Pull-request reviews — shield pr-review posts scan results as a native GitHub review: inline comments on exactly the changed lines that carry findings (rule link, CWE/CVSS, concrete fix) plus one summary comment with severity counts and a mermaid map of affected files. Works without GitHub Advanced Security, so it runs on private and internal repos where SARIF upload is unavailable. --dry-run previews everything.

Zero-config submit — --org is auto-detected when your account has one organization; --project accepts a plain name and creates the project on first use; shield apps list now shows the Org ID.

Valid SARIF for GitHub code scanning — findings without a line number (dependencies, containers, whole-file secrets) previously emitted startLine: 0, which made GitHub reject the entire upload. Fixed.

Eight detection rules revived — a YAML quote-escaping bug had left SHIELD-CPP-005 (unbounded scanf %s) unable to fire at all and seven Dart rules blind to single-quoted strings (the idiomatic Dart style). All eight now fire correctly, pinned by regression tests, with scanner-verified examples on their rule pages.

Actionable dependency findings — every SCA finding now includes concrete remediation (the exact version to upgrade to and where), instead of "no guidance available".

Private-repo scanning fix — a stored project access token now takes precedence over the GitHub App installation token, so server-side scans of repos outside the App's installation work when you save a token for the project.

Small things — shield --version works (not just shield version).

Verify your download

sha256sum -c SHA256SUMS

Shield v0.3.0

Free, MIT-licensed application security CLI. Rules are embedded in the binary — run it locally, offline.

Highlights since v0.1.0

Accuracy — OWASP Benchmark v1.2 score +0.051 → +0.582 (recall 63.7%, precision 92.5%, 2,740 cases), reproducible from the published harness: https://zennoxa.com/research. 341 SAST rules across 24 languages. Framework rule packs (Spring, Laravel, React/Vue/Svelte, Next.js, Express, Django/Flask, Rails) and Java XSS with cross-line taint tracking (source → sink).

Shift-left — shield scan --staged scans only what git has staged, and shield hooks install wires it up as a pre-commit hook. Scoping via .shieldignore / --exclude.

CI gating — --fail-on-severity <critical|high|medium|low>, --fail-on-grade <A–F>, --min-score <0–100> exit non-zero to block a pipeline. Opt-in: without a flag, exit codes are unchanged.

SBOM & compliance — shield sbom emits SPDX 2.3 (CycloneDX already supported); findings map to OWASP Top 10 2021 + CWE Top 25; SARIF 2.1.0 output that GitHub code scanning ingests cleanly.

Dependency scanning — Yarn, pnpm, and Poetry lockfiles; Pub (Dart) and Hex (Elixir) ecosystems; reachability grading marks whether the vulnerable symbol is actually imported/used by your code.

Container scanning — OS-package CVEs for RPM-based images (RHEL, CentOS, Rocky, Alma, UBI9, Fedora — including rpmdb.sqlite), plus end-of-life base-image detection.

UX — human-readable default report output and an interactive command palette on a branded first screen.

Hardening — safer scanning of untrusted repos (FIFO/symlink guards, bounded file reads), stricter token-file permissions, terminal-escape sanitization in output.

Default API — the CLI talks to the public zennoxa.com API when you opt into --submit; scanning itself stays fully offline.

Verify your download

sha256sum -c SHA256SUMS

Shield CLI v0.1.0

First public CLI build — SAST, secrets, dependencies, containers & IaC in one scan.

Install (macOS/Linux): download the binary for your platform below, then:

chmod +x shield-* && sudo mv shield-* /usr/local/bin/shield
shield login && shield scan .

Docs & guide: https://zennoxa.com/guide
Reproducible benchmarks & research: https://zennoxa.com/research

The CLI runs locally — nothing leaves your machine unless you --submit.