Home

Pandaward documentation

Pandaward is a local, evidence-based application security assessment engine. It runs as a Go CLI and as a Claude Code plugin. It is passive by default, keeps a ledger of what it checked and how, and reports undecided controls as plainly as failed ones.

Formerly PenSec. The project was renamed to Pandaward in 0.2.0. Existing projects, approvals and finding IDs carry over; see Moving from PenSec.

Start here

• Installation: Claude Code plugin, prebuilt binaries, go install
• Quick Start: first scan in five minutes
• Troubleshooting: install and usage problems
• Safety Model: what Pandaward will and will not do on your machine and network

Using Pandaward

• CLI Reference
• Claude Code Plugin: skills, agents, hooks, MCP tools
• Findings Lifecycle: confidence, status, triage, remediation
• Retest and Delta: targeted retest after a fix, differences between assessments
• Coverage and Statuses: how to read PASS, FAIL, BLOCKED and the coverage ratio
• Reports
• Evidence Bundles: hand results to a reviewer with verifiable hashes
• Network Testing: scope manifests and approvals
• Configuration
• CI Integration

Reference

• Control Catalog: every control, domain A to R
• Cross-Domain Edges: AB1, CG1, FG1 and the rest
• Optional Scanners: gitleaks, semgrep, osv-scanner, trivy
• Architecture
• Writing a Check
• Benchmark and Self-Test
• Verifying Releases
• Comparison: how Pandaward relates to other scanners
• FAQ

Current version: 0.2.0 (releases).

Pandaward is alpha software. It is not a certification, attestation or independently signed penetration test.