CloudShield
Log inSign up

Comprehensive Security Scanning for Cloud Infrastructure

Start ScanningHow It Works

Find vulnerabilities across every running instance in your cloud fleet. CloudShield runs a multi-scanner SAST ensemble, filters noise with per-language heuristics, and surfaces ranked findings in a single dashboard, without persisting your credentials.

Live preview
Interactive · click a finding to expand
Instance
jetstream2-prod-04
Scanned May 4, 2026 · 14:32 UTC·Jetstream2·Ubuntu 22.04
Live
Total findings
1,247
−18% vs raw
Critical
12
+2 this week
High
84
−6 this week
Medium
203
stable
Low
86
−4 this week
KEV · CISA
0
code-level n/a
FileSeverityScoreClass
auth/session.go:142
Critical9.2TP
Vulnerable· As scanned
Critical
1// Sign upstream API requests
2const apiKey = "sk-prod-9f2a4c83ea71c5d6"
3req.Header.Set("Authorization", "Bearer "+apiKey)
Remediation· Suggested by CloudShield
1// Sign upstream API requests
2apiKey := os.Getenv("UPSTREAM_API_KEY")
3if apiKey == "" {
4  return errors.New("UPSTREAM_API_KEY not set")
5}
6req.Header.Set("Authorization", "Bearer "+apiKey)
Why it matters
A production API key is committed in source. Anyone with read access to the repo (or a leaked build artifact) can sign requests as this service and exfiltrate data from the upstream.
How to apply
Read the key from an environment variable at startup and fail loudly if it's unset. Rotate the leaked key immediately.
api/users.py:87
High8.4TP
lib/upload.ts:31
High7.6TP
scripts/migrate.py:204
Medium5.1UNC
tests/fixtures.go:19
Low2.3FP
Showing 5 of 1,247 findings
Open in dashboard
Platform

Two surfaces built on the same scanning engine

Scanner Engine

A multi-scanner ensemble that runs SAST, dependency, and secret detection in parallel against a target instance, then de-duplicates and ranks every finding through a per-language heuristic filter.

  • Eight scanners bundled into one pipeline
  • Per-language profiles tune the filter
  • Always-on worker, JIT credentials
Insights Dashboard

A triage workspace that turns thousands of raw scanner outputs into a ranked queue of real vulnerabilities, with confidence scores, classification, KEV flags, and remediation context.

  • Code + Packages views per instance
  • CISA KEV catalogue cross-referenced
  • LLM-suggested remediations inline
Scanner Engine
Scanning
Target instance
jetstream2-prod-04
Progress64%
  • Connect · SSHms
  • Pull source · 12,418 files11s
  • SAST ensemble · 7 scannersrunning
  • Heuristic FP filter · per-languagequeued
Findings detected142/ raw
Insights Dashboard
post-filter
Critical
121
High
846
KEV
4
Findings · 7 days−18% vs raw
auth/session.go:142
api/users.py:87
openssl 1.1.1kKEV
Scanner Engine

Find vulnerabilities across
every layer of every instance

Learn more

CloudShield bundles eight industry-standard scanners into a single pipeline. Findings are de-duplicated by file + line + CWE so you never see the same issue twice, no matter how many scanners caught it.

Multi-scanner ensemble
CRITICAL · CWE-7989.2 / 10
auth/session.go:142
const apiKey = "sk-prod-9f2a4c83…"
HIGH · CWE-898.4 / 10
api/users.py:87
query = f"SELECT * FROM u WHERE id={id}"
Filtered out · placeholder credential
tests/fixtures.go:19
Eight scanners, one ranked queue
De-duplicated by file + line + CWE.
Heuristic FP filterv10 · per-language
Base · severity HIGH+8.0
path_test_dir matched−4.0
snippet_sanitized−2.0
cross_scanner_agreement+2.0
Final score4.0 / 10UNCERTAIN
Raw findings
6,124
After filter
1,247
Triage with confidence
0–10 score classifies each finding as TP, uncertain, or filtered.
SAST
Semgrep
Multi-language SAST
SAST
Snyk Code
Taint analysis
Lang
Bandit
Python
Lang
Gosec
Go
Lang
Brakeman
Ruby / Rails
Lang
cppcheck
C / C++
Lang
flawfinder
C / C++
Deps
Trivy
Dependencies & images
How it works

From running instance
to ranked findings, in minutes

CloudShield is built around a four-stage pipeline. The scanner is always on so you point it at your instance, then come back to a ranked queue of real vulnerabilities.

01 / 04
Connect
You submit an instance IP address and passphrase through an end-to-end encrypted channel. The credentials are used JIT to point the scanner at your instance, and they're ephemeral, never persisted to the database.
02 / 04
Scan
An always-on scanner worker connects to the target, then runs eight tools in parallel, SAST, dependency CVEs, secrets, and infrastructure misconfigurations, across every directory in scope.
03 / 04
Filter
Raw scanner output is deduplicated by file + line + CWE, enriched with surrounding source context, and scored 0–10 through a per-language heuristic pipeline that drops noise without dropping real vulnerabilities.
04 / 04
Triage
Ranked findings stream into your dashboard as the scan progresses, with severity, classification, KEV flags, and remediation context. Most scans return in 15–30 minutes; large codebases may take longer.
Embed

Wire CloudShield
into any platform

Most cloud platforms run on JavaScript. Drop in our React component, embed an iframe, or call the REST API directly, same scanner, same heuristics, same ranked queue.

Explore docs
React Component
Drop-in component

Embed CloudShield directly inside any React-based dashboard. The component handles credential prompts, scan triggering, and streaming results, your host app never sees an SSH key.

  • Streaming results · WebSocket
  • In-memory credentials only
  • Theme tokens inherit from host
import { CloudShield } from "@cloudshield/react";

export default function SecurityPanel() {
  return (
    <CloudShield
      tenant={"jetstream-cloud"}
      filter={"moderate"}
      onFinding={(f) => notify(f)}
    />
  );
}
iframe Embed
Or, drop in an iframe

For platforms that aren't on a JavaScript framework, Elm, Vue, plain HTML, anything, CloudShield ships as a hosted iframe. One line, zero build steps.

  • Works in any host stack
  • Postmessage events for findings
  • Single-tenant or shared
your-platform.dev / security
CloudShieldLive · jetstream2-prod-04
CodePackagesModerate
Crit
12
High
84
Med
203
KEV
4
auth/session.go:142TP
api/users.py:87TP
lib/upload.ts:31TP
REST API
Headless integrations

For CI/CD pipelines and custom integrations, talk to the API directly. Trigger a scan, stream findings, or pull a snapshot.

  • Webhook · scan.completed
  • GET /v1/findings · paginated
  • OpenAPI spec available
curl https://api.cloudshield.run/v1/scans \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"host":"10.0.18.42","filter":"moderate"}'

# stream findings as they land
curl https://api.cloudshield.run/v1/scans/$ID/stream \
  -H "Authorization: Bearer $CS_TOKEN"

Safety, Built In

Read the Security Overview
Transient credentials
SSH keys, passphrases, and tokens never touch the database. They exist only in memory for the duration of the scan and are zeroed on session close.
No persisted source
Source code is read, scanned, and discarded. CloudShield retains only the finding metadata such as the file path, line number, rule, score, never your code.
Auditable runs
Every scan emits a signed audit record: who triggered it, which instance, which scanners ran, and what was returned. Stream the audit log to your SIEM.

Latest updates

All posts

Start scanning your
infrastructure today

Sign upContact sales

Point CloudShield at one instance and see real findings, code and packages, ranked, with KEV flags and remediation context, in minutes.