Newborn 
GO Local, evidence-based application security assessment engine and Claude Code plugin
https://pandaward.dev ↗ HEALTH ? 99 / Healthy
Newborn GO // readme
A standalone Go CLI and a Claude Code plugin. Passive by default. Honest about what it did not test.
Most scanners print a list of alerts and stop. PandaWard keeps a ledger: every control it could check, how it checked it, the redacted evidence, and every control it could not decide. Findings are fingerprinted across runs, so a fix becomes REMEDIATED only when the check runs again and no longer sees the problem, and a moved or renamed file keeps its findings, their IDs and your triage instead of reading as fixed.
Why PandaWard
| Safe by default | The default profile only reads the repository. It never runs install scripts, Makefiles or builds, never follows symlinks, and sends no traffic to any target. |
| Human-authorized network tests | Anything that sends a request needs a scope manifest that a person filled in and approved from an interactive terminal. An AI agent cannot approve it. |
| No false “all clear” | Only PASS and FAIL are decisive. A missing scanner is BLOCKED, a crash is ERROR, a heuristic hit is SUSPECTED. None of them count as secure. |
| Evidence, not opinions | Each finding links to a redacted, SHA-256… |