Free CLI · MIT-licensed binary · runs offline
The scanner you install, not upload.
shield scan runs SAST with taint tracking, dependency CVEs, secret detection, and container + IaC checks in one offline pass across 24 languages with 341 rules. No account. Nothing uploaded.
Homebrew (macOS, Linux)
brew install zennoxa/tap/shieldInstaller script (macOS, Linux)
curl -sSL https://zennoxa.com/install | shDownloads the latest release for your OS and architecture and verifies it against the published SHA256SUMS. Read the script before you pipe it.
Direct download
Releases on GitHub with checksums for macOS (arm64, amd64), Linux (arm64, amd64), Windows (amd64).
Windows: download shield-windows-amd64.exe and add it to your PATH.
Current release: v0.6.0. Verify any binary against SHA256SUMS from the same release.
Real output, unedited
This is what the shipped release prints against appsecco/dvna, a public, deliberately vulnerable Node application. Findings are grouped by file, with the offending line and a concrete fix hint under each one.
Counts from that run: SAST 10, container 2, dependencies 35; critical 17, high 12, medium 18. Release v0.6.0, linux-amd64, trimmed to the first findings of two files. Reproduce it: clone the repository and run the command above.
The P column is the offline subset of the Priority Engine: CVSS plus reachability, with EPSS and CISA KEV added for dependency CVEs when the CLI can fetch them. That is why a High-severity SQL injection that untrusted input demonstrably reaches ranks above three Criticals.
One pass, every layer
SAST with taint tracking
341 rules across 24 languages, 14 with comprehensive coverage. Tracks user input through variables to sinks inside a file, which is how the SQL injection above was found two lines away from its source.
Dependencies
Known CVEs from OSV for 10 ecosystems and 18 manifest and lockfile formats, each with the fix version. shield sbom writes CycloneDX or SPDX.
Secrets
27 detectors with entropy checks, so a real key is reported and an example string is not.
Containers
25 Dockerfile and image checks, plus shield image-scan for OS-level CVEs in an image pulled from a registry.
Infrastructure as code
16 checks for Terraform, Kubernetes, CloudFormation and Helm.
Output that fits your pipeline
text, json, sarif, html. SARIF drops straight into GitHub code scanning. Exit codes and --fail-on-severity gate a build.
Commands you will actually use
shield scan . | Scan the current directory (SAST, secrets, containers, IaC). |
shield scan . --deps | Also check dependencies against OSV and emit fix versions. |
shield scan . --format sarif --output shield.sarif | SARIF for GitHub code scanning or any SARIF-aware gate. |
shield sbom | Generate a Software Bill of Materials (CycloneDX or SPDX). |
shield image-scan --os-cve nginx:latest | Scan a container image pulled from a registry. |
shield fix | Deterministic version bumps for vulnerable dependencies (dry-run by default). |
shield hooks install | Run the scan as a git pre-commit hook. |
shield pr-review | Post findings as a GitHub pull-request review. |
shield --help lists every command; the docs cover flags and CI recipes.
Wire it into CI in one step
The GitHub Action installs a pinned release, runs the scan, and can upload SARIF so findings show up in the Security tab of your repository.
# .github/workflows/security.yml
name: Security
on: [push, pull_request]
jobs:
shield:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: Zennoxa/[email protected] # pin a tag; "latest" makes runs incomparable
with:
args: --deps
format: sarif
output: shield.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: shield.sarifAccuracy you can reproduce
+0.582
OWASP Benchmark v1.2 score on 2,740 labelled cases (true positive rate minus false positive rate).
92.5%
Precision on that suite, at 64% recall. Precision-first by design: fewer findings, each worth reading.
0
Bytes of your source uploaded. The scan is a local Go binary; there is no model in the scan path.
Method, per-category scores and reproduce steps: /benchmark. Where the engine scores zero is published too.
What it does not do
- No AST. Detection is rule-based with taint tracking inside a file; data flows across files can be missed.
- No dynamic testing. The CLI reads code and manifests; it does not send requests to a running app.
- No autofix beyond dependencies. shield fix proposes version bumps and is a dry run by default.
- The full Priority Engine with fresh EPSS exploit probability and CISA KEV for every finding runs in the hosted dashboard. Offline, the CLI ranks with CVSS and reachability, and adds EPSS and KEV only for dependency CVEs it can look up.
Questions
Does my code leave my machine?
No. The CLI scans locally and works offline. The only network calls are the optional dependency lookup against OSV when you pass --deps, and --submit, which uploads findings (not source) to your own dashboard if you choose to.
Is the CLI open source?
The CLI is a free, MIT-licensed binary with public releases and checksums. The engine source is not published. We say that plainly rather than calling it open source.
Do I need an account?
No. Install, run shield scan, read the output. An account only matters if you want the hosted dashboard, history, and the live Priority Engine on top.
What does the CLI not do?
It does not parse an AST: detection is rule-based with taint tracking inside a file, which is why cross-file data flows can be missed. It does not run dynamic tests. It does not rewrite your code; shield fix only proposes dependency version bumps. Offline, the ranking uses CVSS and reachability; the fresh exploit signals (EPSS, CISA KEV) for every finding come from the hosted dashboard.