Optional Scanners

Optional scanners

Pandaward uses these only if you installed them. It never downloads or installs tools.

Adapter	Control	Network	Notes
gitleaks	E-005	no	runs detect --no-git --redact; values are redacted by gitleaks and again by Pandaward
semgrep	D-006	only for registry packs	runs Pandaward's bundled offline rules (SSRF, path traversal, template injection; see rules/) plus .pandaward/semgrep/ and scan.semgrep_config; --config auto is refused because it sends project metadata; metrics are off
osv-scanner	I-003	yes	queries the OSV database; needs scan.allow_tool_network: true
trivy	J-005	yes	trivy config for IaC; needs scan.allow_tool_network: true
apktool	K-005	no	decodes .apk files found in the project with apktool d --no-src (resources and manifest only, the app's code is never run) and runs the Android manifest checks on the result; needs Java

When a tool is missing, its control is BLOCKED with the reason. When it fails, the control is ERROR and the assessment is INCOMPLETE.

All five adapters are implemented_unvalidated. apktool is not exercised in CI yet. CI runs the other four on every pull request against gitleaks 8.30.1, semgrep 1.182.0, osv-scanner 2.7.0 and trivy 0.76.1 on the bundled vulnerable fixture and fails when an adapter does not complete or its parser misses the expected findings. Other versions may work but are not checked. Reports of mismatches are welcome.

Check what is installed:

pandaward doctor