I have spent 18 years building software across SaaS, fintech and payments, much of it in regulated, audited and security-sensitive environments. Today most of my open-source time goes into PandaWard, a local application security assessment engine that keeps evidence for every finding and says plainly what it did not test. Alongside it I build payment infrastructure at Payshen, maintain tooling for payment developers and review payment, webhook and auth code in other projects.

Application security assessment for your own repositories that also tells you what it did not test. Most scanners print alerts and stop; PandaWard keeps a ledger of every control it could check, how it checked it and the redacted evidence, and lists every control it could not decide. Passive by default, network tests only after a person approves the scope. Formerly PenSec, renamed in 0.2.0.

• Honest coverage: only PASS and FAIL are decisive; blocked, unsupported or suspected controls never count as secure.
• Evidence, not opinions: each finding links to a redacted, SHA-256 addressed evidence record and is fingerprinted across runs, so a fix counts only when the check runs again.
• No AI-confirmed findings: review agents can only record hypotheses, and the engine reads and redacts the cited lines itself.
• Wide static coverage: secrets, injection sinks, CI/CD, containers, Terraform, Android and iOS manifests, webhooks, MCP and LLM output reaching exec sinks.
• Reports and CI: HTML, Markdown, JSON, SARIF 2.1.0 and CSV, with a --fail-on gate. Release binaries are reproducible, with checksums, an SBOM and signed provenance.

/plugin marketplace add ratomirjovanovic/pandaward
/plugin install pandaward@pandaward            # macOS and Linux
/plugin install pandaward-windows@pandaward    # Windows
/pandaward:scan

Live demo · Website · Docs · Quick start · Releases · Roadmap

Paste an API response, webhook or postback and see what the provider reported, what the code means, which events belong together and what looks wrong. Nothing leaves the browser.

• Deterministic analysis: structural provider detection, documented error catalogs, correlation by explicit identifiers and explainable diagnostic rules.
• Wide coverage: card processors, wallets, pay-by-bank, crypto and high-risk billing providers, each with an honest capability manifest.
• Privacy by design: sensitive data redacted from everything shown or exported, identifiers masked, strict Content Security Policy, no server-side processing.
• Three ways to run it: a static demo, an offline CLI and a Next.js app with a passkey-protected admin area.

Live demo · Demo video (1 min) · Docs · Releases · Roadmap · Good first issues

Official client libraries for the Payshen payment orchestration API: payments, captures, voids, refunds, events and webhook verification. Published and maintained on four registries.

PHP · Python · WooCommerce

Recent public reviews, mostly payment, webhook and security changes. The last column shows what GitHub recorded after the review: whether the author pushed changes, whether I approved, and whether the pull request was merged.

_{20 pull requests in 16 projects · 9 revised by their authors after the review · 7 merged}

Problems I found while integrating or reviewing other projects, reported upstream.

Fixes I wrote for other projects that their maintainers merged.

_{The Adyen fixes follow #1816, an HMAC validation issue I reported and Adyen confirmed. Related fixes for the PHP, Python, Go and Ruby libraries are in review.}

_{This card and the review list above are generated daily from public GitHub data. My contribution activity is GitHub's own overview, below this README.}

Area	Tools
Languages
Frameworks
Data and cloud
Delivery