While collaborating on security workflows and repository audits, we noticed a glaring blind spot. Just because a GitHub issue is closed as fixed does not mean the corresponding code was actually merged. Security scanners like Trivy, Grype, and OSV-Scanner do a fantastic job catching dependency CVEs, and tools like Gitleaks or TruffleHog are excellent for finding secrets. However, absolutely none of them verify a project's issue tracker claims against the actual repository reality. Security auditors need a definitive, automated way to know if a cited fix PR actually made it into the codebase. We built ShimGuard to eliminate this gap by reporting a definitive MATCH, MISMATCH, or UNVERIFIED status. What started as a lightweight check quickly evolved into a robust CLI and library architecture. To maximize accessibility, we expanded the build process to ship as packages on both npm and PyPI. Basic merge-status checking was simply not enough, so the tool evolved to include an optional deep-inspection feature to confirm that the vulnerable code pattern is actually absent at HEAD. To ensure teams could adopt it without security concerns of their own, we locked down the architecture to be completely read-only and released it under an open-source MIT license. Repo: https://github.com/RudrenduPaul/... MCP Servers: https://mcpservers.org/servers/r... https://glama.ai/mcp/servers/Rud... NPM: https://www.npmjs.com/package/sh... PyPI: https://pypi.org/project/shimgua... We are excited to get this into your hands. What specific edge cases in GitHub issue tracking do you think we should tackle in our next update?

ShimGuard

Verify merged status of PR fixes for closed issues"

Verify merged status of PR fixes for closed issues"