WAF++ PASS v1.1.0 Demo — Fully interactive with sample data. All waivers, scan and auto-fix actions are simulated. α AGENTIC α AUTO-FIX
WAF++ Logo WAF++
Score

Last scan: 2026-03-23 14:30
Passed Controls
Failed Controls
Skipped Controls
Waived Controls
WAF++ Score
/100
Score by Pillar
Cloud Footprint
Regions
Failed Controls by Severity
Critical & High Failures
Pass Rate by Category
Run a scan to see category breakdown.
Regulatory Readiness
No regulatory mappings found in scan results.
Architectural Debt Heatmap
Low
High
Quick Wins
Medium & low severity failures — lower effort to remediate
No controls match your filters.
Open in IDE:
Control Pillar Severity Status Checks

Waivers allow you to intentionally accept risk for specific controls. Export as .wafpass-skip.yml.

No waivers configured. Add waivers from the Controls Library.
Total Accepted
Active
Expiring in 30d
Overdue / Expired

Formal risk acceptances require approver sign-off, an RFC or ticket reference, and a defined residual risk level.

No risk acceptances recorded. Click Add Risk Acceptance to begin.

Tip: Only controls with findings will impact your score.

Approval
Risk Classification
Timeline

Required fields: Control, Justification, Approver

Global Deployment Map
Detected Regions
No region data available. Run a scan to detect deployed regions.
Demo mode — results are simulated client-side. The live server evaluates code against all 80+ WAF++ controls in real time.
sandbox.tf
HCL · Terraform

Load a template or paste Terraform,
then click Run Sandbox Scan.

Evaluating controls…

Remediation ROI estimates based on industry benchmarks
Est. Annual Risk
if left unaddressed
Savings if Fixed
estimated risk reduction
Fix Effort
engineering hours est.
Controls to Fix
failing controls
/100
Pass
Fail
Skip
Demo Mode: Scan will simulate a 1.8-second run and refresh the dashboard. No actual IaC files are required.

Scan Configuration

Maturity Level

Select the level that reflects your organisation's current cloud compliance posture. Selecting a level pre-configures recommended feature defaults — you can still adjust any setting individually below.

Level 1
Foundational
Getting started with cloud compliance
  • →Critical severity only
  • →Security & Cost pillars
  • →Intelligence features off
  • →No framework mapping
Startup
Level 2
Operational
Running compliance as standard practice
  • →High+ severity, active pillars
  • →Secret scanner + blast radius
  • →GDPR, BSI C5, ISO 27001
  • →Auto-fix & ESG off
GDPR BSI C5 ISO 27001
Level 3
Governed
Multi-pillar coverage with CI gating
  • →All severities, all 8 pillars
  • →Compliance gating + risk scoring
  • →Risk Acceptance register
  • →Auto-fix & carbon off
SOC 2 NIS2
Level 4
Optimized
Continuous compliance at scale
  • →All severities, all 8 pillars
  • →Auto-fix engine + carbon tracking
  • →Evidence Locker + Audit Log
  • →Fail-on-skip pipeline gating
SOC 2 NIS2 HIPAA
Level 5
Excellence
Full intelligence stack, continuous compliance
  • →All 73 controls · 8 pillars
  • →Full intelligence suite enabled
  • →Drift + dependency tracking
  • →Continuous audit + ESG
All Frameworks Active

General Settings

Scan Defaults

These defaults pre-fill the Run Scan form and are passed as CLI flags when generating commands.

Intelligence Features

Enhanced analysis modules that run alongside the core control checks. Disabling them speeds up scans in resource-constrained environments.

Secret Scanner
Detect exposed API keys and credentials in IaC
Auto-fix Engine α
Generate concrete remediation patches for FAIL controls
Carbon & ESG Tracking
Estimate carbon footprint per control, included in PDF
Blast Radius Display
Show impact score per control to prioritise remediation
Reporting

Control how scan results are presented and exported.

Auto-open PDF after export
Automatically open the generated PDF report in a new tab

Settings are persisted in browser local storage and survive page reloads.

WAF++ PASS v1.1.0 — includes the new AGENTIC pillar and the radical command-center dashboard. All waivers, scans, and auto-fix actions in this page are simulated for demo purposes.

Installation

Requirements
Python 3.10+ Terraform .tf files or CDK project WAF++ Controls (YAML) No cloud credentials required
From GitHub Release

Download the .whl artifact from the latest release and install via pip.

# Download from GitHub Releases
pip install wafpass-0.3.0-py3-none-any.whl
From Source

Clone the repository and install in editable mode. Works with pip or uv.

# Standard pip
pip install -e .

# Or with uv (faster)
uv pip install -e .
Quick Start
# 1. Download WAF++ controls into a local controls/ directory
#    (from the WAF++ framework repo or author your own YAML controls)

# 2. Run a scan against your IaC directory (Terraform default)
wafpass check ./infra/

# 3. Specify IaC framework explicitly
wafpass check ./infra/ --iac terraform

# 4. Multi-cloud / multi-path scan
wafpass check ./aws ./azure ./gcp

# 5. Launch the web UI dashboard
wafpass ui start
# → http://localhost:8080

# 6. Export a PDF compliance report
wafpass check ./infra/ --output pdf
CI/CD Integration

Use --fail-on fail to break pipelines on control failures. Native GitHub Actions and GitLab CI examples are available in the documentation. Intentional exceptions go in .wafpass-skip.yml and appear as WAIVED in reports without breaking CI.

Release History

v1.1.0 Current July 2026
New Features
  • ✓ New AGENTIC pillar for autonomous AI governance
  • ✓ Expanded control catalogue to 8 pillars
  • ✓ Radical dark "command center" dashboard theme
  • ✓ Deployed regions in compliance output
  • ✓ Sandbox environment support
  • ✓ Risk acceptance (waivers) with justification
  • ✓ Auto-fix engine for automated remediation
  • ✓ Carbon footprint estimation (ESG)
  • ✓ Secret scanner with remediation guidance
Fixes & Infrastructure
  • ✓ Policy version bumped to 1.1.0
  • ✓ Favicon added to web UI
  • ✓ Mobile-responsive command-center layout
v0.1.1 Beta March 2026
  • • Release workflow corrected for GitHub Actions PyPI publishing
  • • Release workflow fix attempt
v0.1.0 Beta March 2026
New Features
  • • Alicloud, Yandex Cloud, Oracle Cloud support
  • • Executive summary & decision board in PDF reports
  • • Multi/split report mode for per-pillar reports
  • • Intentional skip support with skip file
  • • Risk estimation in PDF reports
  • • OpenStreetMap integration & regional spread map
  • • Regulatory mapping (GDPR, BSI, ISO 27001)
Engine & Fixes
  • • Dynamic pillar loading without code changes
  • • PDF export of compliance results
  • • Security pillar (Pillar 1) checks
  • • Financial impact split into distinct root groups
  • • CLI skip file path resolution corrected
Initial Commit February 2026

WAFPass repository initialized.

Critical Paths
Internet-facing entry
High Severity
Significant risk paths
Entry Points
5
Public-facing surfaces
Data Stores at Risk
4
Potentially reachable
Attack Surface ←→
INTERNET PERIMETER APPLICATION DATA STORE CORE
Attack Graph
Select a path card below to highlight its attack chain
INTERNET PERIMETER APPLICATION DATA STORE CORE NET Internet Attacker S3 S3 Bucket Public ACL ALB Load Balancer Public EC2 EC2 Instance Public IP APP App Server EC2/ECS λ Lambda Function ECS Container ECS/Fargate RDS Database Critical Data S3 S3 Data Private DDB DynamoDB Table IAM IAM Full Access SM Secrets Mgr Credentials KMS KMS Keys Encryption
Attack Chains

These exploit paths are illustrative attack chains based on common cloud misconfiguration patterns aligned to WAF++ controls. They represent theoretical attack scenarios; actual exploitability depends on your specific infrastructure configuration and compensating controls in place.

Demo Mode: Secret Scanner simulates credential detection client-side. No files leave your browser.
No findings yet.

Blast radius combines downstream resource count, data sensitivity and internet exposure to prioritise fixes.

Control Pillar Severity Downstream Resources Blast Radius Priority
P1 Critical Paths
P2 High Paths
Total Downstream Resources
vs
Diff Summary
Annual Exposure
Potential Savings
Estimated ROI
Control Severity Annual Exposure Fix Cost Net Savings
No sprint tasks yet.
Progress:

Controls marked SKIP were not evaluated, usually because the required resource type was absent or the control was intentionally disabled.

Current Pillar Coverage

Earn badges by reaching security, cost and compliance milestones. Badges reset when new failures are introduced.

Overall Score
Open Findings
Exceptions
Maturity Level
Passport Widget HTML

      

    


    
    

      

        
        
        
      

      

        

          
            

              Time
              Event
              Actor
              Details
            

          
          
            
          
        

      

    


  








  

    
  








  

    
  








  

    
Edit Waiver — 

    

      

        
        
      

      

        

          
          
        

        

          
          
        

      

      

        
        
      

    

  








  

    
  








  

    
    

      

        

          
        

        

          
New Control

          

            Step  of 7 —
            
            · 
          

        

      

      
    


    
    

      
    


    
    


      
      

        

          Describe in plain language what your infrastructure must enforce. This becomes the control description that engineers will read in scan results.
        

        
        
        

          
        

      


      
      

        

          Choose the security pillar this control belongs to. It determines the control ID prefix and how findings are categorised.
        

        

          
        

      


      
      

        

          

            
            
            

              Auto-suggested from pillar prefix. Edit freely — must be unique.
            

          

          

            
            

              
            

          

        

      


      
      

        

          Select one or more control types that describe how this control is enforced. Choose all that apply.
        

        

          
        

        
Select at least one type to continue.

      


      
      

        

          
Define individual checks that implement this control. Each check maps to a specific engine assertion.

          
        

        

          No checks yet. Click "+ Add check" to define a check.
        

        
      


      
      

        

          Review the generated YAML before saving. Use Previous to go back and make edits.
        

        

        
        

          
Validation

          

            
          

        

      


      
      

        
        

          

            ✓
            

              
Control saved (demo mode)

              

                 is ready for export.
              

            

          

          

            
Export

            

              
            

          

          

            
Use with wafpass CLI

            

          

        

        
        

          

            
ID

            
Pillar

            
Severity

            
Types

            
Checks

          

          
          

            Go back and fix validation errors before saving.
          

        

      


    


    
    

      
      

      

        
        
      

    

  








  

    
    

      

        

          
        

        

          
How to Implement

          
Integration guide for WAF++ controls

        

      

      
    


    
    

      Mode:
      

        
        
      

    


    
    

      
      
      
      
    


    
    


      
      

        

          

            WAF++ CLI is the primary way to run controls against Terraform infrastructure. Install it with pip and point it at your IaC.
          

          

            
1. Install

            
pip install wafpass

          

          

            
2. Run a scan

            
wafpass scan --path ./terraform

          

          

            
3. Get a score report

            
wafpass scan --path ./terraform --output json > results.json

          

        

      


      
      

        

          

            
From a local controls folder

            
Drop your YAML control files in a controls/ directory and point wafpass at it:

            
wafpass scan --path ./terraform --controls ./controls/

          

          

            
From wafpass-server (DB)

            
Start wafpass-server locally and use the --controls-db flag to pull custom controls:

            
# Start the server
docker run -p 8000:8000 ghcr.io/waf-plus-plus/wafpass-server:latest

# Scan using DB controls
wafpass scan --path ./terraform --controls-db http://localhost:8000

          

        

      


      
      

        

          

            Push scan results to wafpass-server so this dashboard can visualise posture over time.
          

          

            
Push results to dashboard

            
wafpass scan --path ./terraform --push http://your-server:8000

          

          

            
View in dashboard

            
open http://your-server:8000

          

        

      


      
      

        

          

            Use the Download Checkov Pack button to get Python stubs for all controls, then load them as external Checkov checks.
          

          

            
1. Install Checkov

            
pip install checkov

          

          

            
2. Download & extract the pack

            
# Click "Download Checkov Pack" above, then:
unzip wafpass_checkov_pack_*.zip

          

          

            
3. Run Checkov with custom checks

            
checkov -d ./terraform --external-checks-dir ./wafpass_checks/

          

        

      


      
      

        

          

            Each Python stub in the pack is a BaseResourceCheck subclass with a scan_resource_conf method. Replace the raise NotImplementedError with your actual check logic.
          

          

            
Example stub

            
def scan_resource_conf(self, conf):
    # Check that encryption is enabled
    enc = conf.get("server_side_encryption", [{}])
    if enc and enc[0]:
        return CheckResult.PASSED
    return CheckResult.FAILED

          

          

            
Folder structure

            
wafpass_checks/
├── __init__.py
├── WAF-SEC-001.py
├── WAF-SEC-002.py
└── ...

          

        

      


      
      

        

          

            Add WAF++ controls as a step in your GitHub Actions pipeline to enforce compliance on every PR.
          

          

            
GitHub Actions example

            
name: WAF++ Compliance Check

on: [pull_request]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Checkov
        run: pip install checkov

      - name: Download WAF++ Checkov Pack
        run: |
          curl -sSL https://your-server:8000/api/checkov-pack \
            -o wafpass_checkov_pack.zip
          unzip wafpass_checkov_pack.zip

      - name: Run WAF++ Checkov checks
        run: |
          checkov -d ./terraform \
            --external-checks-dir ./wafpass_checks/ \
            --output github_failed_only \
            --soft-fail