Reports

Reports

pandaward report                                  # formats from config
pandaward report --format html,sarif --out dist   # specific formats and directory

Format	Audience	Contents
HTML	people	self-contained page, no scripts, light and dark
Markdown	people, pull requests	same structure as HTML
JSON	automation	full report model including the assessment manifest
SARIF 2.1.0	code scanning	open findings with source locations and fingerprints
CSV	assurance	per-control and per-edge coverage ledger

Every report contains: assessment ID, code revision (and whether the tree was dirty), profile, catalog and generator versions, an executive summary, confirmed findings, suspected signals, coverage by domain, cross-domain edges, the full control ledger, tool runs, closed findings with reviewer notes, and the evidence index with SHA-256 hashes.

Reports are written to .pandaward/reports/ with mode 0600 and are gitignored. They describe weaknesses of your project, so share them deliberately.