Every layer, every language, and where it stops.

25 config checks, always on

Every Dockerfile, docker-compose and Kubernetes manifest in a connected repo is scanned — 14 Dockerfile/compose rules and 11 Kubernetes rules — plus 6 image-config rules that read the pushed image’s metadata.

Pull & scan a pushed image

Point Shield at an image in any registry. It reads the manifest, config and build history — not the multi-gigabyte layer blobs — so it stays fast and light. Private repos and Harbor robot accounts included.

Opt-in: OS-package CVEs in the layers

When you want the layer contents too, add a flag and Shield inventories the installed OS packages and checks them for known CVEs:

Terraform 6 · Kubernetes 7 · CloudFormation 3

Every Terraform file, Kubernetes manifest and CloudFormation template in a connected repo is scanned automatically — catching the misconfigs that quietly become breaches: wildcard IAM, public buckets, privileged pods, unencrypted storage.

From your CI job, shield gate-report posts a pass/fail commit status and a PR / MR comment back to your git provider. On GitHub it also posts a Check Run with inline file-and-line annotations on the new findings a PR introduces (up to 50). Break the build on what the priority engine says actually matters — not on a wall of noise.

Providers

Reports export as text, HTML, JSON and SARIF 2.1.0. The CLI exits 0 on pass and 2 on a gate violation, so CI stops the build; --staged scopes a pre-commit hook to staged files only.

1 · Static config pre-check always on

Shield reads your nginx / apache / .htaccess config and source and flags 11 web-exposure mistakes (DAST-001…011): weak or disabled TLS, wildcard CORS, non-HTTPS endpoints, missing security headers, directory listing, open redirects, disabled CSRF, insecure cookies, no rate limiting, and debug mode left on.

2 · Live-endpoint probe opt-in

Aim Shield at a running endpoint — your staging host, before a deploy — and it probes for the mistakes that only appear at runtime, across four families:

Security grade

Starts at 100 and deducts a penalty per finding — −45 critical, −18 high, −6 medium, −1.5 low — each scaled 0.6–1.4× by that finding’s priority (exploitability). A single critical floors the grade at F.

Code grade

A maintainability read from lines of code, a complexity proxy, duplicate blocks (≥6 lines), long functions (>60 lines), deep nesting and a test-ratio signal.

A configurable quality gate (per org or per project, scoped to branches like main or release/*) can fail the build on a severity count, a specific CWE, a minimum grade or a minimum score.

CycloneDX 1.4 · SPDX 2.3

From the versions Shield resolved out of your lockfiles, shield sbom emits a machine-readable inventory in both CycloneDX 1.4 (the default) and SPDX 2.3 — each component carrying a Package URL (PURL) so downstream tooling can identify it exactly, deduplicated across manifests. Runs fully offline.

A local model (Ollama / Qwen) writes a plain-language explanation and a suggested fix for each finding, which you review. When the model is off or unreachable it falls back cleanly to 20 hand-written templates covering the common rule types, so you always get context. Everything from the scanned repo is neutralized against prompt injection before it reaches the model.