Quick Start

Quick start

Install Pandaward first (Installation). Then run these in the root of a project you own or are authorized to assess.

pandaward init       # creates .pandaward/ and prints what the inventory found
pandaward plan       # which controls apply, which are automated, which need a human
pandaward routes     # entrypoints Pandaward discovered, with file and line
pandaward scan       # passive scan
pandaward findings   # open findings, confirmed first
pandaward fix-plan   # ordered remediation
pandaward report     # .pandaward/reports/*.html, .md, .json, .sarif

pandaward assess runs init, scan and reports in one step.

In Claude Code there is nothing to type beyond asking Claude to check the project's security, or /pandaward:start. Claude runs the whole assessment, asks one question at the end and carries out what you choose, retesting after every fix and after later edits. See Hands-free use.

Reading the scan output

Assessment asmt_0001_20261027T114349Z: COMPLETE
Adapters:
  builtin-code       OK           1 signals  code heuristics
  builtin-cicd       OK           2 signals  1 workflows
  gitleaks           BLOCKED      0 signals  gitleaks is not installed (optional; run `pandaward doctor`)
Controls: BLOCKED 8, FAIL 3, INCONCLUSIVE 1, NOT_APPLICABLE 24, PASS 15, SUSPECTED 1, UNSUPPORTED 4
Decisive coverage: 18/32 applicable controls (56%). Edges: 4 (0 verified, 1 failed, 3 open)

• COMPLETE means every enabled adapter finished; INCOMPLETE means one errored or the run timed out. An incomplete run is never a clean run.
• Decisive coverage counts PASS and FAIL over applicable controls. It is not the share of vulnerabilities found. See Coverage and Statuses.
• BLOCKED controls need a tool, an approval or a human review.

Fix and retest

# edit the code
pandaward retest --changed   # re-run only what the changes affect
pandaward diff               # what changed between the last two assessments

retest lists changed files, re-runs the scan and reports remediated, reopened and new findings. A finding becomes REMEDIATED only when the check that found it runs again successfully and no longer sees it. See Retest and Delta.

Files Pandaward creates

Path	Commit it?	Contents
.pandaward/config.yaml	yes	settings
.pandaward/scope.yaml	your choice	network test authorization
.pandaward/.gitignore	yes	keeps private data out of git
.pandaward/private/	no	SQLite ledger, redacted evidence, raw tool output
.pandaward/reports/	no	rendered reports