ShimGuard

What is ShimGuard, and why does it exist

ShimGuard is a CLI and library, shipped as both an npm package and a PyPI package, that checks whether a GitHub issue's claimed fix ("Fixed in PR #N") is actually true, by checking the real merge state of that PR (and, optionally, whether the vulnerable code pattern is still present atHEAD). It exists because closing an issue with a citation to an unmerged PR is a real, observed failure mode, not a hypothetical one:sybil-solutions/codex-shim, a 1,000+-star project, has 6 security issues closed this way as of this writing, each citing the same unmerged PR #52. ShimGuard does not scan for secrets in source code (seegitleaks,trufflehogfor that) and does not do general vulnerability scanning against dependencies (seeosv-scanner,trivy,grype). It verifies one specific, narrow claim: does a tracker's "fixed" status match reality.

Does ShimGuard modify my repo or the target repo?No. It only makes read-only GitHub API requests (issues, comments, pull requests, and optionally file contents). It never writes, comments, or mutates anything.

Does it need a GitHub token?No for occasional use. Unauthenticated requests work, subject to GitHub's standard rate limit (60 requests/hour). SetGITHUB_TOKENor pass--tokenfor the higher authenticated limit (5,000 requests/hour), useful in CI.

What counts as a "cited fix"?ShimGuard looks for phrases like "Fixed in PR #52", "fixed by #101", or "resolved in #20" in the issue body and its comments, and extracts the referenced PR number. If no such phrase is found, the result isUNVERIFIED, notMATCHorMISMATCH: ShimGuard never guesses.

Can I use this in CI?Yes.shimguard verifyexits1when any MISMATCH is found, so a CI step can gate on it directly.--format jsongives a stable, parseable report for a bot or dashboard.

Why "ShimGuard" if it doesn't scan BYOK shim configs?An earlier framing of this idea was a broader local-config security scanner for BYOK (bring-your-own-key) model shims. That scope was narrowed to the sharper, more defensible wedge: verifying tracker claims against actual merged code, which is what shipped in v0.1. The name reflects the project's origin case (sybil-solutions/codex-shim, a BYOK model shim), not a scope this version doesn't have.

Does ShimGuard work on Windows, macOS, and Linux?The npm CLI requires Node.js 18 or later (for the built-infetchAPI) and runs anywhere Node runs, including Windows, macOS, and Linux. The PyPI package requires Python 3.9 or later and lists itself as OS Independent in its own classifiers. Neither package has a native or compiled dependency.

How is ShimGuard different from gitleaks or trufflehog?Gitleaks and trufflehog scan file content for secrets accidentally committed to a repo, things like API keys and tokens. ShimGuard does not scan file content for secrets at all -- it checks GitHub's issue and pull-request API for one specific mismatch: an issue closed as "fixed in PR #N" where PR #N never actually merged. The two tool categories catch different failure modes and can run in the same pipeline without overlapping; see "How it compares" above for the full list of adjacent tools this project checked before writing a line of code.

Why mightshimguard --versionprint a different number than the installed package?In some past releases, runningshimguard --versionreported a version string that lagged behind the installed package's actual version -- the version string passed tocommanderinsrc/cli.tswas not always bumped in the same release as apackage.jsonversion bump. It is a display-only mismatch and does not affectverifybehavior. To check the actual installed version, read the package's ownpackage.jsonor runnpm view shimguard-cli version.

Does ShimGuard scan every closed issue in a repo automatically?No. You pass the specific issue numbers to check with--issues 38,41,42; ShimGuard does not currently walk a repo's full closed-issue history looking for cited-fix claims on its own. For a large repo, pick the issues you care about, for example the ones taggedsecurityor tied to a release milestone.

Can I use ShimGuard in a commercial product or a paid CI pipeline?Yes. ShimGuard is MIT licensed (see](https://github.com/wow-actions/auto-close-fixed-issues)LICENSE), which permits commercial use, modification, and redistribution, including inside a paid product or internal tool, with no royalty and no requirement to open-source your own code. Keeping the MIT notice is the only condition.

Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB