Configuration

Configuration

.pandaward/config.yaml (schema v1):

schema_version: 1
project:
  name: my-app
profile: local-passive          # the only allowed default profile
inventory:
  exclude: [node_modules, vendor, dist, build, .git, .next, target, .venv, .pandaward, .terraform]
  max_file_bytes: 2097152       # 2 MiB; larger files are listed as gaps
  max_files: 200000
scan:
  max_duration_minutes: 45
  adapter_timeout_seconds: 600
  fail_on_adapter_error: true
  allow_tool_network: false     # lets optional scanners fetch advisory data; never targets
  semgrep_config: ""            # local rules path, or a registry pack with allow_tool_network
  adapters: [builtin-inventory, builtin-secrets, builtin-code, builtin-cicd, builtin-infra,
             builtin-supply, builtin-mobile, apktool, mobsf, gitleaks, semgrep, osv-scanner, trivy]
  sarif_files: []               # extra SARIF files to import, relative to the project root
  mobsf_url: ""                 # MobSF on this machine, e.g. http://127.0.0.1:8000; key in MOBSF_API_KEY
report:
  formats: [html, markdown, json, sarif]
  include_untested: true
policy:
  ai_analysis: opt_in
runtime:
  zap_path: ""                  # ZAP launcher if not on PATH or in the default location
hooks:
  auto_retest: true             # Claude Code Stop hook retests files edited in a turn

Unknown keys are rejected, so a misspelled setting fails loudly instead of being ignored. The list of excluded directories above is shortened; pandaward init writes the full default list. Entries with a * match directory names as a glob, such as .next-*. The .pandaward and .pensec state directories at the project root are always skipped, whatever the list says. The list applies to every adapter, not only the built-in checks: results that gitleaks, semgrep or another scanner reports in an excluded directory are dropped, and the adapter line says how many (from 0.2.7).

hooks.auto_retest only affects the Claude Code plugin. With false, edited files are still marked stale, but nothing is retested until you or Claude run a retest. A missing hooks section means true. Older pandaward binaries reject the hooks key, so update the CLI together with the plugin.

Removing an adapter from scan.adapters makes its controls BLOCKED with the reason "disabled in config".

A local semgrep rule directory at .pandaward/semgrep/ is picked up automatically, in addition to PandaWard's bundled offline rules.

SARIF 2.1.0 files in .pandaward/sarif/*.sarif and the paths in scan.sarif_files are imported on every scan. PandaWard never runs the tools that produced them. Imported results are hypotheses under control R-002, with snippets read and redacted from your files rather than taken from the SARIF.

The format of this file is frozen as schema v1; see Schemas and compatibility.