Small nonprofits hold donor records, beneficiary data and sometimes health information on infrastructure that has never been checked by anyone. Shield checks it, writes the findings in plain English, and helps fix them. Free, and only ever with written permission.
Zero audits have been delivered. No client org has signed anything and no volunteers are trained. The parent organization is not incorporated, has filed nothing with the IRS and has nothing pending, so nothing given to it is deductible on anyone's return and none is being asked for. What follows is the design and the scanner it rests on.
The Problem
A food bank knows the addresses of families in crisis. A clinic holds health records. A legal aid group holds immigration files. A shelter holds the location of people hiding from someone. All of it sits in a donor database, a shared drive and a website that a volunteer set up in 2019, and none of it has ever been looked at by someone whose job was to look at it.
A commercial penetration test starts in the thousands. For an organization running on grants and goodwill, that is not a line item, so the check simply never happens. The consequence lands on the people the organization exists to protect.
What It Is
Built on DIRA, an open-source scanner that already exists and works: leaked secrets, known vulnerabilities in dependencies via OSV.dev, configuration and infrastructure rules, dependency licence risk, credentials left in git history, and live TLS and security-header checks. A trained volunteer reviews everything before it reaches the client, because a raw scan output is noise, not a report.
Read about DIRA, the underlying scanner →The report names what is wrong, what could happen because of it, and what to do first — written for an executive director, not for a security team that does not exist. There is nothing to buy at the end. We are not upselling a service, because there is no service to sell.
How It Works
The client org signs an engagement letter naming exactly which systems are in scope, who owns them, and the window. Nothing is touched before this exists.
Trained student volunteers run the audit within that scope, supervised, using read-only and non-disruptive checks.
Findings are triaged, false positives removed, and written up in plain English with a prioritised remediation order.
We follow up, help where we can, and count the engagement only when findings are actually fixed. Found is not the metric. Fixed is.
Who It's For
The Hard Line
Scanning a system you have not been given written permission to scan is a federal computer-crime problem, regardless of intent and regardless of how helpful the findings would have been. So the engagement letter comes first, always, and the scope in it is the boundary of everything that happens next.
Miftah Foundation performs security assessments only under written authorization from the system owner, strictly within the scope defined in the signed engagement letter. Assessments are point-in-time and best-effort; they do not guarantee the absence of vulnerabilities and do not constitute a compliance certification.
Honest Status
The scanner exists and works. DIRA v1.5.1 is MIT-licensed and zero-dependency, with seven scanners, SBOM output in CycloneDX and SPDX, safe auto-remediation, diff-based gating and over 200 automated tests. The technical capability behind this program is not hypothetical.
Zero audits have been delivered. No client org has signed anything, the engagement-letter template has not been reviewed by an attorney, no volunteers are trained, no supervision structure exists, and the parent organization is not incorporated or insured. Nothing in this program can start before those are real.
Year-one targets — targets, not results
First 100 Days
Counted from the day an attorney agrees to review one document. Of the four programs this is the one with the most ways to do real harm, so the first fifth of the plan is entirely paperwork and nobody touches a keyboard.
Scope definition, system ownership, the assessment window, liability, and what happens to findings. A student drafting this from a template and calling it done is exactly the failure mode this gate exists to prevent. No client is approached before it is signed off.
Written rules of engagement, read-only tooling, a documented escalation path for anything found that looks like a live breach, and a named professional who reviews every report before it leaves. Three trained people beat thirty signups.
One small organization holding data that would hurt someone if it leaked. Verify their charitable registration, agree the systems in scope in writing, name their owner for each, and set the window. Anything not on that list stays untouched.
Read-only and non-disruptive checks only, within the signed scope, supervised throughout. Then the unglamorous half: triage every finding, strip the false positives, and rank what is left by what could actually happen.
Plain English, prioritised, with nothing to buy at the end — and a walkthrough conversation rather than a PDF over the wall. The report goes to the client and to nobody else, ever.
Help where we can, re-check the critical findings, and record the engagement in the shared ledger with remediation as the outcome value. Findings discovered is a vanity number; findings closed is the program.
Get Involved
A security professional willing to supervise student volunteers, and an attorney willing to review the engagement letter. Those two unblock everything else. If you run a small nonprofit and want to be first in the queue, say so now.
Two signatures unblock everything else.
Say whether you can supervise, review the engagement letter, or want your nonprofit first in the queue.