Comparison

Comparison

PandaWard does not replace the scanners below. Four of them are optional adapters: when they are installed, PandaWard runs them, redacts their output and records the result in its ledger. This page says what each tool is for, how PandaWard relates to it, and what PandaWard does not do. Claims about other tools are limited to what their own documentation describes; follow the links to check them.

What PandaWard adds

These points describe documented PandaWard behavior. Each one links to the page that explains it.

	PandaWard	Where to check
Undecided controls	Reported as BLOCKED, UNSUPPORTED, INCONCLUSIVE, ERROR or STALE, never counted as secure	Coverage and Statuses
Coverage	Decisive coverage = (PASS + FAIL) / applicable controls; zero after files change until you re-scan	Coverage and Statuses
Finding lifecycle	Fingerprinted across runs; REMEDIATED only after the check runs again and no longer sees the problem; moved files keep their findings and triage	Findings Lifecycle, Retest and Delta
Evidence	Redacted, SHA-256 addressed records; bundles can be verified by a reviewer	Evidence Bundles
Secrets in output	Masked before they are stored, printed, reported or returned to a model	Safety Model
Cross-domain links	Edges such as BC1 (identity to authorization) created from shared assets, with their own status	Cross-Domain Edges
Network access	None in the passive profile; network tests need a scope manifest approved from an interactive terminal	Network Testing
Claude Code	Skills, read-only agents, hooks and an MCP server over the same engine	Claude Code Plugin

Tool by tool

Tool	What it is for (per its docs)	How PandaWard relates
Gitleaks	Finding secrets in git history, directories and files	Optional adapter for control E-005. PandaWard runs detect --no-git --redact, so it scans the working tree, not history. Its own 16 built-in secret formats run without gitleaks.
Semgrep	Rule-based static analysis for many languages	Optional adapter for control D-006. Runs PandaWard's bundled offline rules plus your own; --config auto is refused because it sends project metadata.
OSV-Scanner	Known vulnerabilities in dependencies, matched against the OSV database	Optional adapter for control I-003. Needs network, so it runs only with scan.allow_tool_network: true. PandaWard's built-in supply chain checks (missing lockfiles, install scripts, unpinned requirements) do not look up advisories.
Trivy	Vulnerabilities, misconfigurations, secrets and licenses in images, filesystems, repositories and Kubernetes	Optional adapter for control J-005, using trivy config for IaC only. Needs scan.allow_tool_network: true.
CodeQL	Semantic code analysis with data flow queries	Not run by PandaWard. SARIF files you produce with CodeQL or another analyzer can be imported (.pandaward/sarif/ or scan.sarif_files, see Configuration); their results are hypotheses under R-002. PandaWard's built-in code rules match single lines and do not follow data flow; on the OWASP Benchmark for Java they score 0.00 (see BENCHMARKS.md).
ZAP	Dynamic testing of running web applications, passive and active scans	Optional runtime adapter for M-001 and D-005 (pandaward test --profile staging-active, from v0.1.5). PandaWard runs your installed ZAP with a spider, the passive scan and, if the scope manifest allows it, the active scan, and sends every ZAP request through its scope guard. It does not use ZAP's authentication, AJAX spider or API scans; authorization is tested separately with PandaWard's own identity checks. See Network Testing.

When to use something else

• You need data flow analysis. Use CodeQL, Semgrep or another analyzer that follows data flow, and import its SARIF into PandaWard to keep the results in the ledger. PandaWard's line heuristics are a first pass, not a substitute.
• You need authenticated or deep dynamic testing. PandaWard's ZAP run is unauthenticated and limited by the scope budget. Use ZAP or a similar tool directly, under your own authorization, for logged-in areas and longer scans.
• You need secret scanning of git history. Run gitleaks directly on the repository history.
• You need a certification or a signed penetration test. A PandaWard report is an automated technical assessment, not either of these.

Maturity

PandaWard is alpha software. All adapters are implemented_unvalidated; the optional tool adapters are checked in CI against specific versions of each tool (listed in the README). pandaward capabilities prints each adapter's maturity, and Benchmark and Self-Test explains how the built-in rules are measured.