Free, MIT-licensed application security CLI. Rules are embedded in the binary — run it locally, offline.
What's new in v0.4.0
One-command CI onboarding — shield ci init run once inside your repo: mints a dedicated CI token, writes a hardened GitHub Actions workflow (pinned binary + checksum verification, full-history secrets scan, SARIF, gate report), and stores the secret via the gh CLI when available. No IDs to copy — the project is created from your repo name on the first scan.
Pull-request reviews — shield pr-review posts scan results as a native GitHub review: inline comments on exactly the changed lines that carry findings (rule link, CWE/CVSS, concrete fix) plus one summary comment with severity counts and a mermaid map of affected files. Works without GitHub Advanced Security, so it runs on private and internal repos where SARIF upload is unavailable. --dry-run previews everything.
Zero-config submit — --org is auto-detected when your account has one organization; --project accepts a plain name and creates the project on first use; shield apps list now shows the Org ID.
Valid SARIF for GitHub code scanning — findings without a line number (dependencies, containers, whole-file secrets) previously emitted startLine: 0, which made GitHub reject the entire upload. Fixed.
Eight detection rules revived — a YAML quote-escaping bug had left SHIELD-CPP-005 (unbounded scanf %s) unable to fire at all and seven Dart rules blind to single-quoted strings (the idiomatic Dart style). All eight now fire correctly, pinned by regression tests, with scanner-verified examples on their rule pages.
Actionable dependency findings — every SCA finding now includes concrete remediation (the exact version to upgrade to and where), instead of "no guidance available".
Private-repo scanning fix — a stored project access token now takes precedence over the GitHub App installation token, so server-side scans of repos outside the App's installation work when you save a token for the project.
Small things — shield --version works (not just shield version).
Verify your download
sha256sum -c SHA256SUMS