FAQ

FAQ

How do I install it? In Claude Code: /plugin marketplace add ratomirjovanovic/pandaward, then /plugin install pandaward@pandaward (macOS, Linux) or /plugin install pandaward-windows@pandaward (Windows), then restart. Without Claude Code, download a binary from the releases page. See Installation; for errors see Troubleshooting.

How do I update? Plugin: turn on auto-update for the pandaward marketplace in /plugin, or run /plugin marketplace update pandaward and claude plugin update pandaward-windows@pandaward (pandaward@pandaward on macOS and Linux), then restart. CLI: brew upgrade pandaward, scoop update pandaward, a new release binary, or go install ...@latest again. Existing .pandaward/ ledgers are migrated automatically. See Installation.

Does Pandaward update itself? No. Pandaward makes no network requests of its own, so it never checks for new versions. Claude Code, Homebrew, Scoop or winget do the updating.

How do I remove it completely? Uninstall the plugin or package, then delete .pandaward/ in each project and, if you want, the approval key in your user config directory. The Uninstalling section of Installation lists every step and every file.

Does Pandaward prove my application is secure? No. It reports what it decided, with evidence, and lists what it did not decide.

Why is coverage so low? Many important controls (authorization, business logic, session handling) cannot be decided from source alone. Pandaward reports them as BLOCKED or UNSUPPORTED instead of pretending. The guided assessment (/pandaward:start) has read-only specialist agents review those areas; /pandaward:review runs that review on its own.

Does it send my code anywhere? No. The CLI makes no network requests in the passive profile. If you use the Claude Code plugin, Claude reads what the skills and tools return, which is redacted.

Can Claude run network tests on its own? No. Approval requires an interactive terminal, the PreToolUse hook asks you before pandaward test, and the /pandaward:test skill can only be started by you.

Why are some findings in test files low severity or missing? Code heuristics skip test, fixture and example paths and say so in the run detail. Secret checks still scan them at low severity, because test credentials are sometimes real.

Is it open source? Yes, AGPL-3.0-only. Commercial licensing is available for uses that cannot meet the AGPL terms.

Which platforms? Linux and macOS on amd64 and arm64, Windows on amd64. CI runs on all three systems.

How do I know a binary is genuine? Check it against SHA256SUMS and its signed build provenance; see Verifying Releases.