Garden is a one-URL automated asset discovery and passive security scanning tool designed for authorized targets. It performs passive, read-only scans (bounded GET requests within same-origin boundaries) without active exploitation. The tool supports two primary modes: quick (anonymous) scans and authenticated coverage analysis across three fixed contexts (anonymous, user, admin). Outputs include structured Markdown reports with asset inventory, evidence, security control observations, and explicit coverage gap explanations, emphasizing that zero findings do not imply safety unless coverage is fully qualified. The architecture is a Python 3.10+ application using FastAPI for the web API, Typer for the CLI, SQLAlchemy with Alembic for database management, and Playwright for browser automation during login and inventory collection. The system follows a service layer pattern shared by CLI, Web, and API entry points, with a multi-stage pipeline (validate → collect → normalize → compare coverage → replay authorization → analyze → report) orchestrated by ScanApplicationService. External dependencies include httpx for HTTP requests, Pydantic for data validation, and Jinja2 for templating. Garden is positioned as an internal AppSec workflow for post-authentication verification of authorized application surfaces, not as a general-purpose vulnerability scanner like Burp or ZAP. It features centralized redaction of sensitive data across all outputs, an ephemeral secret store for temporary credential handling, and a plugin-based security check system with six built-in low-risk checks. The codebase includes extensive test coverage (unit, integration, e2e), a comprehensive threat model, and detailed implementation plans for versioned releases (v0.2 trusted report quality, v0.3 passive authenticated coverage).