No scan results yet
Run a scan against your IaC directory to see your security posture.
No scan results yet. Run a scan first.
Waivers allow you to intentionally accept risk for specific controls. They are exported as .wafpass-skip.yml.
Formal risk acceptances require approver sign-off, an RFC or ticket reference, and a defined residual risk level.
No risk acceptances recorded. Click Add Risk Acceptance to begin.
Tip: Only controls with findings will impact your score.
Required fields: Control, Justification, Approver
Deployed Regions
Region List
Load a template or paste your Terraform,
then click Run Sandbox Scan.
Evaluating controls…
Scan Configuration
Absolute or relative path to your Terraform (or other IaC) files.
Maturity Level
Select the level that reflects your organisation's current cloud compliance posture. Selecting a level pre-configures recommended feature defaults — you can still adjust any setting individually below.
- →Critical & High severity only
- →Security & Cost pillars (P1–P2)
- →Fast feedback, minimal overhead
- →Intelligence features off
- →No regulatory framework req.
- →Medium+ severity, all active pillars
- →Waivers, risk register, PDF reports
- →Secret scanner + blast radius on
- →GDPR, BSI C5, ISO 27001 mapped
- →Auto-fix & ESG tracking off
- →All severities, all 7 pillars
- →Full intelligence suite enabled
- →Auto-fix engine + ESG/carbon tracking
- →Full audit trail, multi-pillar reports
- →All regulatory frameworks mapped
General Settings
These defaults pre-fill the Run Scan form and are passed as CLI flags when generating commands.
Enhanced analysis modules that run alongside the core control checks. Disabling them speeds up scans in resource-constrained environments.
Control how scan results are presented and exported.
Settings are persisted in browser local storage and survive page reloads.
Public beta — WAFPass v1.0 is planned alongside Framework v1.0, shortly before 12 May 2026. All versions below v1.0 are beta. The API, controls, and scoring model may still change.
Installation
Download the .whl artifact from the latest release and install it via pip.
# Download from GitHub Releases pip install wafpass-0.3.0-py3-none-any.whl
Clone the repository and install in editable mode. Works with pip or uv.
# Standard pip pip install -e . # Or with uv (faster) uv pip install -e .
# 1. Download WAF++ controls into a local controls/ directory # (from the WAF++ framework repo or author your own YAML controls) # 2. Run a scan against your IaC directory (Terraform default) wafpass check ./infra/ # 3. Specify IaC framework explicitly wafpass check ./infra/ --iac terraform # 4. Multi-cloud / multi-path scan wafpass check ./aws ./azure ./gcp # 5. Launch the web UI dashboard wafpass ui start # → http://localhost:8080 # 6. Export a PDF compliance report wafpass check ./infra/ --output pdf
Use --fail-on fail to break pipelines on control failures. Native GitHub Actions and GitLab CI examples are available in the documentation. Intentional exceptions go in .wafpass-skip.yml and appear as WAIVED in reports without breaking CI.
Release History
- ✓ Web UI dashboard for compliance visualization
- ✓ Mobile-responsive dashboard theme
- ✓ Deployed regions in compliance output
- ✓ Sandbox environment support
- ✓ Risk acceptance (waivers) with justification
- ✓ Auto-fix engine for automated remediation
- ✓ Carbon footprint estimation (ESG)
- ✓ Secret scanner with remediation guidance
- ✓ Blast radius scoring per control
- ✓ Favicon added to web UI
- ✓ Permitted Git workflow documented
- • Release workflow corrected for GitHub Actions PyPI publishing
- • Release workflow fix attempt
- • Alicloud, Yandex Cloud, Oracle Cloud support
- • Executive summary & decision board in PDF reports
- • Multi/split report mode for per-pillar reports
- • Intentional skip support with skip file
- • Risk estimation in PDF reports
- • OpenStreetMap integration & regional spread map
- • Regulatory mapping (GDPR, BSI, ISO 27001)
- • Dynamic pillar loading without code changes
- • PDF export of compliance results
- • Security pillar (Pillar 1) checks
- • Financial impact split into distinct root groups
- • CLI skip file path resolution corrected
WAFPass repository initialized.
No active exploit chains detected — no relevant security controls are currently failing in this scan.
Exploit chains are derived from controls that are actively failing in your scan. Affected resources shown are the specific Terraform resources that triggered failures. Exploitability depends on your runtime compensating controls and network configuration beyond IaC scope.