Evidence Bundles

Evidence bundles

A bundle is a zip you can hand to a reviewer, an auditor or a teammate. It contains the JSON report, every redacted evidence record of one assessment and a manifest with the SHA-256 of each file. Raw tool output is never included.

Create

pandaward export --bundle review-2026-11.zip                    # latest assessment
pandaward export --bundle review.zip --assessment asmt_0007     # a specific one

PandaWard refuses to overwrite an existing file. It prints the manifest SHA-256 at the end. Send that value to the recipient through a different channel than the zip (chat, ticket, phone).

Verify

pandaward verify-bundle review-2026-11.zip

The recipient's PandaWard recomputes every hash, checks it against the manifest and prints the manifest SHA-256. If it matches the value the sender gave, the bundle is exactly what was exported.

What is and is not inside

Included	Not included
report.json	raw scanner output
redacted evidence records	source files
manifest.json with hashes, project, assessment, versions	the ledger, approvals or the approval key

Evidence is redacted when it is recorded, so secret values are already masked. A bundle still describes weaknesses of your project: share it deliberately.

The manifest format is frozen as schema v1; see Schemas and compatibility.