Shield v0.3.0

Free, MIT-licensed application security CLI. Rules are embedded in the binary — run it locally, offline.

Highlights since v0.1.0

Accuracy — OWASP Benchmark v1.2 score +0.051 → +0.582 (recall 63.7%, precision 92.5%, 2,740 cases), reproducible from the published harness: https://zennoxa.com/research. 341 SAST rules across 24 languages. Framework rule packs (Spring, Laravel, React/Vue/Svelte, Next.js, Express, Django/Flask, Rails) and Java XSS with cross-line taint tracking (source → sink).

Shift-left — shield scan --staged scans only what git has staged, and shield hooks install wires it up as a pre-commit hook. Scoping via .shieldignore / --exclude.

CI gating — --fail-on-severity <critical|high|medium|low>, --fail-on-grade <A–F>, --min-score <0–100> exit non-zero to block a pipeline. Opt-in: without a flag, exit codes are unchanged.

SBOM & compliance — shield sbom emits SPDX 2.3 (CycloneDX already supported); findings map to OWASP Top 10 2021 + CWE Top 25; SARIF 2.1.0 output that GitHub code scanning ingests cleanly.

Dependency scanning — Yarn, pnpm, and Poetry lockfiles; Pub (Dart) and Hex (Elixir) ecosystems; reachability grading marks whether the vulnerable symbol is actually imported/used by your code.

Container scanning — OS-package CVEs for RPM-based images (RHEL, CentOS, Rocky, Alma, UBI9, Fedora — including rpmdb.sqlite), plus end-of-life base-image detection.

UX — human-readable default report output and an interactive command palette on a branded first screen.

Hardening — safer scanning of untrusted repos (FIFO/symlink guards, bounded file reads), stricter token-file permissions, terminal-escape sanitization in output.

Default API — the CLI talks to the public zennoxa.com API when you opt into --submit; scanning itself stays fully offline.

Verify your download

sha256sum -c SHA256SUMS