Safety Model

Safety model

An assessment tool that can be tricked into harming the system it assesses is a liability. These rules are enforced in the Go engine, not in prompts.

Passive by default

• The repository is read as data. Pandaward never runs install scripts, Makefiles, build steps or repository hooks. git runs with hooks and fsmonitor disabled.
• Symlinks are not followed. Files above inventory.max_file_bytes and binary files are skipped and listed as inventory gaps.
• .env*, private keys, keystores and credential files are recorded by name only. Their contents are never read.
• The local-passive profile sends no network traffic to any target.

Secrets

• Every snippet, message and tool output line passes through redaction before it is stored, printed, reported or returned over MCP. Secret formats, key = value assignments with sensitive names, bearer and basic credentials, cookies and email addresses are masked.
• Terminal escape sequences and bidirectional control characters are stripped from untrusted text.
• Tests assert that seeded secrets never appear anywhere under .pandaward/.

Optional scanners

• Only binaries you installed are used. Pandaward never downloads tools.
• They run with an argument array (no shell), a scrubbed environment without cloud or VCS tokens, a disposable HOME, a timeout and an output size cap.
• Scanners that need network access for advisory databases are BLOCKED until you set scan.allow_tool_network: true. That setting never permits traffic to your targets.
• A non-zero exit, a crash or unparsable output is ERROR, never a clean result.

Network tests

See Network Testing. In short: a human-written scope manifest, an approval that only works from an interactive terminal and is bound to the manifest's SHA-256, a request budget and rate limit, no redirects, and connection-time address checks that refuse private, loopback and cloud metadata addresses.

AI and agents

• The ledger is the source of truth. Model summaries never are.
• Agents in the plugin are read-only (Read, Grep, Glob and Pandaward read tools). They cannot run commands, edit files or reach the network.
• Agents can only record a HYPOTHESIS. Pandaward reads and redacts the cited lines itself, so a model cannot inject evidence.
• The MCP server exposes no tool that approves scope, sends network traffic or confirms a finding.
• A PreToolUse hook asks the human before pandaward scope approve, pandaward test, finding disposition changes, direct access to the private ledger, and edits to the scope or config manifests. Edits to .pandaward/private/ are denied. In the hands-free flow Claude runs disposition commands itself, but each one still goes through this prompt, so the decision stays with you.
• The Stop hook's automatic retest is the same local, passive, changed-only retest as pandaward retest --changed, with the same adapters and policy. It sends no network traffic and cannot change dispositions.
• Repository text that looks like instructions ("ignore previous instructions") is treated as data and can be flagged as a prompt-injection attempt.

What a report claims

Only what was decisively tested, for the stated scope, method and time. Every report carries this boundary: an automated technical assessment, not a certification, attestation, legal opinion or signed penetration test.