Monk CI Shield
Scan every pull request for secrets, vulnerabilities and misconfigurations, review access, and enforce branch policy across your GitHub organization.
Monk CI Shield scans every pull request in your organization for committed secrets, code vulnerabilities, vulnerable dependencies, and insecure infrastructure code. It also reports who has access to what, and which repositories are missing branch protections.
Set it up from the Monk CI dashboard with a five-step wizard.
Start here
Activate in Monitoring mode.
Monitoring reports findings on pull requests and never blocks a merge. It is the default on the Activate step. Clear your critical and high findings, then switch to Active to start blocking pull requests that fail a scan.
Change mode at any time from Shield → Settings → Enforcement mode.
Before You Start
| Requirement | Why |
|---|---|
| Shield is enabled for your organization | Shield is in beta and switched on per organization. If there is no Shield entry in your sidebar, email us. |
| You are a GitHub organization owner or admin | Activation creates an organization ruleset, which only owners and admins can do. |
| Your org is on GitHub Team or Enterprise | GitHub offers organization rulesets on paid org plans only. |
| The Monk CI debug-agent GitHub App is installed | The wizard installs it for you in step 1 if it is not already. |
Pages in This Section
Enable Shield
Install the app, review existing tools, choose scanners and repositories, activate.
Choose Your Scanners
What each of the four detection engines covers, and when to leave one off.
Triage Findings
Read the Overview, filter the findings list, check repository coverage.
Review Access
Check teams and permissions, and act on detected access risks.
Apply Branch Policy
Grade repositories against the governance checklist and close the gaps.
Change Your Settings
Toggle scanners, switch enforcement mode, adjust repository coverage, deactivate.