PandaWard

PandaWard

Local, evidence-based application security assessment for your own code.

A standalone Go CLI and a Claude Code plugin. Passive by default. Honest about what it did not test.

Website and demo · Documentation · Quick start · Limitations

---

Most scanners print a list of alerts and stop. PandaWard keeps a ledger: every control it could check, how it checked it, the redacted evidence, and every control it could *not* decide. Findings are fingerprinted across runs, so a fix becomes REMEDIATED only when the check runs again and no longer sees the problem, and a moved or renamed file keeps its findings, their IDs and your triage instead of reading as fixed.

A real session on the bundled demo project, generated by tools/termdemo .

Findings from a real scan of the bundled vulnerable fixture. Open the live demo for the terminal replay and the full report.

Why PandaWard

Formerly PenSec. The project was renamed to PandaWard in 0.2.0. If you used PenSec, see Moving from PenSec.

Quick start

As a Claude Code plugin

/plugin marketplace add ratomirjovanovic/pandaward

/plugin install pandaward@pandaward # macOS and Linux /plugin install pandaward-windows@pandaward # Windows

You can also run the same steps from a terminal with claude plugin marketplace add ratomirjovanovic/pandaward and claude plugin install pandaward-windows@pandaward (pandaward@pandaward on macOS and Linux). Restart Claude Code afterwards; /mcp should list plugin:pandaward:pandaward as connected. Install only one of the two plugins. If something goes wrong, see Troubleshooting.

Updating. Claude Code does not update third-party marketplaces on its own unless you turn it on. Either turn on auto-update once (/plugin, then Marketplaces, pandaward, Enable auto-update), or update by hand:

claude plugin marketplace update pandaward

claude plugin update pandaward-windows@pandaward # or pandaward@pandaward on macOS and Linux

Then restart Claude Code. /plugin shows the installed version.

Uninstalling. claude plugin uninstall pandaward-windows@pandaward (or pandaward@pandaward), then claude plugin marketplace remove pandaward. Results stay in each project's .pandaward/ directory until you delete it. The uninstall guide covers the CLI packages and every file PandaWard creates.

Then, in your project, ask Claude to check its security, or run:

/pandaward:start

That is the only command. Claude scans the project, has specialist reviewers look at what automation could not decide, triages the results, builds the fix plan and writes the reports, with a live checklist. At the end it asks one question - fix the plan, record the triage results, install missing scanners - and does what you choose, retesting after every fix. Later in the session it retests on its own whenever code changes. Commands that change a finding's status still show you a confirmation prompt, and network tests always need a scope you approve in your own terminal.

Individual skills

The plugin installs prebuilt, checksum-verified binaries from the plugin and plugin-windows branches, which the release workflow publishes on every version tag (how to verify them). To use PandaWard without Claude Code, see below.

As a CLI

With a package manager:

brew tap ratomirjovanovic/pandaward https://github.com/ratomirjovanovic/pandaward && brew install ratomirjovanovic/pandaward/pandaward   # macOS, Linux

scoop bucket add pandaward https://github.com/ratomirjovanovic/pandaward; scoop install pandaward/pandaward # Windows

Or download a binary from the releases page (Linux and macOS on amd64 and arm64, Windows on amd64). For example on Linux:

v=v0.2.13

curl -fLO https://github.com/ratomirjovanovic/pandaward/releases/download/$v/pandaward-linux-amd64 curl -fLO https://github.com/ratomirjovanovic/pandaward/releases/download/$v/SHA256SUMS sha256sum --ignore-missing -c SHA256SUMS chmod +x pandaward-linux-amd64 && sudo mv pandaward-linux-amd64 /usr/local/bin/pandaward

On Windows (PowerShell), save pandaward-windows-amd64.exe as pandaward.exe in a folder on your PATH:

Invoke-WebRequest https://github.com/ratomirjovanovic/pandaward/releases/download/v0.2.13/pandaward-windows-amd64.exe -OutFile pandaward.exe

(Get-FileHash pandaward.exe).Hash # compare with the line in SHA256SUMS

Or install with Go 1.26 or later: go install github.com/ratomirjovanovic/pandaward/cmd/pandaward@latest. The binary has no runtime dependencies.

Update with brew upgrade pandaward or scoop update pandaward; for a downloaded binary, replace the file with the new release. Remove with brew uninstall pandaward or scoop uninstall pandaward, or delete the binary. pandaward version shows what you have.

Then, in your project:

pandaward assess          # init, scan with progress, reports and a summary

pandaward findings # then dig in pandaward fix-plan

Release binaries are reproducible and come with checksums, a CycloneDX SBOM and signed build provenance; docs/VERIFYING.md shows how to check them.

How it works

flowchart LR

subgraph Claude Code S[Skills /pandaward:*] --> M[MCP server] A[Read-only agents] --> M H[Hooks] --> L end CLI[pandaward CLI] --> E M --> E[Engine] E --> I[Inventory read-only walk] E --> AD[Adapters built-in + optional tools] E --> P[Scope and policy fail closed] AD --> R[Redaction] R --> EV[Evidence store SHA-256] E --> L[(SQLite ledger)] L --> RP[Reports HTML MD JSON SARIF CSV]

1. Inventory walks the repository read-only and records files, routes, manifests, workflows, IaC, mobile manifests and AI/MCP usage.
2. Plan maps the control catalog (domains A to R) onto what was found. Controls without matching assets become NOT_APPLICABLE with a reason you can review.
3. Adapters run. Built-in checks are offline and always available; gitleaks, semgrep, osv-scanner, trivy and apktool are used only if you installed them. osv-scanner and trivy also need scan.allow_tool_network: true, which is off by default: osv-scanner then sends the package names and versions from your lockfiles to api.osv.dev, and trivy only downloads its vulnerability database. Until it is set they are BLOCKED with a reason that says this, and /pandaward:start offers the switch once. When an override in the workspace root (pnpm.overrides, overrides or resolutions in package.json, or overrides in pnpm-workspace.yaml) replaces a package with a local one (link:, file:, workspace: or portal:), an osv-scanner result for that package is dropped if the lockfile entry is that local package, since the registry package's advisories do not apply to code that is not installed; the adapter line counts them and names the overrides. A result is kept, and named in the adapter line, when the lockfile still pins a registry version or the override is an npm: alias. A gitleaks match whose value is shaped like a placeholder (a run of 8 or more sequential or repeated characters, a word such as dummy, example or changeme, a value starting with test_, a JWT with a short signature or dummy claims, or the fallback after secrets.NAME || in a workflow) is kept but listed as info for review instead of counting against E-005; the value is judged in memory and never stored, a service_role JWT is never treated as a placeholder, and the adapter line says how many were listed. apktool decodes .apk files found in the project (resources only, never the app's code) so the manifest checks also run on what you ship (K-005). If you run [MobSF](https://github.com/MobSF/Mobile-Secu