Overview
Shieldome supports multiple users working on the same account. Team members can view scan history, run new scans, and download reports. This page explains how to invite team members, manage their access, and share scan results.
User roles
| Role | Can do |
|---|---|
| Owner | Everything — billing, inviting users, deleting the account, managing API keys, all scans |
| Admin | Run scans, view all results, manage API keys, invite and remove members (cannot change billing) |
| Member | Run scans, view all results, download reports. Cannot manage users or API keys. |
| Viewer | View and download scan results only. Cannot trigger new scans. |
Inviting a team member
- Go to Settings → Team
- Click Invite Member
- Enter the person's email address
- Select their role (Member is appropriate for most developers)
- Click Send Invitation
The invitee receives an email with a link to create their account (or log in if they already have one) and accept the invitation. Pending invitations are shown in the Team settings page.
Removing a team member
- Go to Settings → Team
- Find the user and click Remove
- Confirm the removal
Removed users immediately lose access to all scans and reports. Their past scan contributions remain in the account history with their name attributed.
Sharing a scan result
Every scan has a shareable link. To share:
- Open the scan result in the app
- Click the Share button at the top right
- Copy the link
Anyone with the link who is a member of your account can view the result. The link does not grant access to other scans or account settings.
To share with someone who does not have a Shieldome account, download the PDF report and send it to them directly. The PDF contains the full findings and remediation guidance.
Scan visibility
All scans are visible to all team members. There is no private scan mode — if you need to test a sensitive internal URL, use the IP Override field so the scan goes directly to your server without the URL appearing in shared history in a recognisable form.
API keys and team access
API keys created by any Admin or Owner can be used by all team members for CI/CD integrations. Each key can be labelled (e.g. "GitHub Actions - production") to make it clear which pipeline it belongs to. Go to Settings → API Keys to manage keys.
Best practices for teams
- Enable 2FA for all members — Security accounts with multiple users are a higher-value target. Require 2FA for all Admins and Owners at minimum.
- Use one API key per pipeline — Label each key with where it's used. If a key leaks, you can rotate only that key without disrupting other pipelines.
- Assign Viewer role to stakeholders — Give product managers, legal, or auditors a Viewer account so they can pull reports on demand without needing to ask developers.
- Set up webhooks for critical findings — Configure a Slack or Jira webhook (see the Webhooks guide) to alert the whole team when a critical vulnerability is found, not just the person who ran the scan.