CI integration

Deploy security gate for GitHub Actions and CI

Ship fast without skipping security on the live surface. After your app publishes, call POST /v1/hooks/deploy for URL-only gates or POST /v1/hooks/release to combine URL scan with optional boundary evaluation. Shield returns a gate verdict, shareable report link, and optional webhook payload when the scan completes.

• Unified POST /v1/hooks/release accepts URL consent plus boundary policy_id and events in one webhook payload.
• Policy object fail_on lets you fail CI on critical or high findings only.
• Drift tracking compares this deploy against the previous scan on the same URL.
• Works with Cloudflare Pages, Railway, Vercel, or any host once the URL is live.
• Consent flag required: only scan targets you own or have permission to test.

Copy curl example SARIF export

Close the gap after Motor succeeds

Many teams discover misconfigurations only after customers hit the live site. A deploy gate catches missing security headers, exposed admin surfaces, and Supabase misconfigurations on the URL customers actually use, not a staging hostname that diverged weeks ago.