What's new
A version-by-version history of Fendix. v3.7.0 shipped October 2026: the GitHub Action fails the job when Semgrep cannot run, and a fatal Semgrep run is recorded as failed instead of passing as a clean scan. Each entry below lists what changed in that release.
Spec-file upload + false-positive precision — scan from an uploaded OpenAPI spec
June 2026
- Scan from an uploaded OpenAPI/Swagger spec file. You can now start an API scan by uploading a spec file directly, instead of only pointing at a hosted
/schema/URL — for internal or pre-prod APIs whose schema isn't publicly reachable, or specs exported from other tools. JSON and YAML are accepted; the upload is size-capped and parsed with YAML aliases disabled (billion-laughs-safe) before the engine reads it. - FastAPI auth check scoped to real FastAPI routes. The "route missing authentication dependency" check matched any
@object.method(...)decorator with no framework check, so on Django/DRF projects it flagged Celery tasks (@shared_task), DRF actions (@action), drf-spectacular getters (@extend_schema_field) and even Pydantic validators (@field_validator) as unauthenticated FastAPI routes. It now fires only inside files that actually use FastAPI, only on real HTTP-verb routes, and recognisesDepends/Security/Annotated[...]auth — eliminating that false-positive class (a real Django monorepo dropped from 256 to 10 findings, the 10 being genuine unauthenticated routes in embedded FastAPI services). - Sharper password-exposure guard. The black-box password-field check no longer fires on i18n/label dictionaries (where
"password"is just the translated UI label), while genuine plaintext-credential leaks — verbose user records, combined payloads, and non-Latin credentials — are still flagged. The guard now keys off the matched value's shape instead of a blunt body-wide heuristic. - Taint-analysis false positives suppressed. A batch of whitebox taint false positives surfaced by real-world scans were closed, each backed by a regression case, tightening precision without dropping recall.
CI-integration hardening — container fix, fewer false positives, stable suppressions
June 2026
- Whitebox taint engine now loads in containers. The runtime image set
FENDIX_PYTHON_ENGINE, but the binary resolves the engine viaFENDIX_ENGINE— so in every Docker run the Python taint engine silently fell back to a missing path and disabled itself, leaving only the native Go scanners. The Dockerfile now exports the variable the engine actually reads, so interprocedural auth/injection taint analysis runs in CI and any other container. - Fewer secret false positives, at the source. The secrets scanner now recognises a *reference* to a secret (an AWS Secrets Manager ARN, an
rds!db-managed-secret name, a GCPprojects/*/secrets/*resource) versus an actual credential value, and filters unambiguous placeholders (YOUR_TOKEN_HERE,<...>,${VAR},changeme). Deliberately narrow — it never suppresses on the bare substringexample, so AWS's documented example keys are still flagged. These two classes previously needed hand-written per-line suppressions. - Stable finding fingerprints for durable suppressions. Every finding now carries a content-derived
fingerprint(hash of category + location + title) that doesn't change between runs, unlike the positionalSEC-NNNid..fendix-ignoregains afingerprint:rule (andfendix ignore validaterecognises it) so a suppression keeps matching across scans and code moves instead of silently drifting onto the wrong finding. The baseline diff shares the same identity. - Coverage is no longer silent + baseline fails closed. Reports now include
endpoints_discoveredandendpoints_truncatedso a scan capped by--max-endpointsis distinguishable from a complete one (no more invisible partial coverage). And a corrupt--baselinefile now fails the run (exit 2) instead of silently scanning with no diff — a missing baseline still fail-opens for the legitimate first run.
DAST module upgrade — 15 black-box checks, 3 critical fixes
June 2026
- Black-box DAST expanded 8 → 15 checks. Seven new check types ship in this release: cookie-flags (passive, CWE-1004/614/1275 — missing
Secure/HttpOnly/SameSite), open-redirect (active, CWE-601), reflected XSS (active, CWE-79), in-band SSRF (active, CWE-918), host-header injection (active, CWE-644/601), GraphQL introspection (active, CWE-200), and HTTP method tampering (active, CWE-650/693/285). The full registered set is now configleak, headers, cors, exposure, ratelimit, cookie-flags, auth, idor, injection, open-redirect, xss, ssrf, host-header, graphql, and method-tamper. - 3 criticals fixed.
addAuthdouble-prefix (auth header value getting the scheme prepended twice on retry), an SSRF-guard bypass that affected 6 active checks (the guard ran before payload mutation on those paths), and a redirect-follow path that re-issued requests without re-validating the resolved IP against the private/loopback denylist. - 45 verified accuracy fixes. A batch of false-positive reductions across the active and passive probes, each backed by a regression case, sharpening precision without dropping recall on the labeled corpus.
- New finding categories. The report schema now emits
xss,cookie,redirect,host_header,graphql, andmethod_tamperalongside the existing categories, so the dashboard and SARIF output classify the new check types correctly.
Runs on every commit — diff-aware scans, pre-commit hook, transitive Python SCA
June 13, 2026
- Diff-aware scan — `fendix scan --code . --diff --staged --fast`. Resolves changed files via
git diffand threads a file-allowlist through every whitebox scanner; SCA runs only when a manifest/lockfile changed. Scopes a scan to just the files a commit touches — ~18ms on a 200-file monorepo, fast enough to run on every commit instead of only in CI. (Distinct from the existing--baselinefinding-suppression mechanism.) - Pre-commit hook — `fendix hook install`. Drops a pre-commit script that runs the diff-aware scan (secrets + textscan, sub-second budget) and blocks the commit the moment a secret or HIGH+ finding is staged. Honours
core.hooksPath, refuses to clobber a foreign hook, andgit commit --no-verifyis the escape hatch. - Proven Path v1 (SAST taint chains). For Python/Django/Flask/FastAPI, route-table extraction binds a request route to its handler and exports the full route → handler → source → sink taint chain as SARIF
codeFlows/threadFlows, so GitHub renders the step-through inline in the Security tab. A newsource_tierprovenance tag (native_go/tree_sitter_sidecar/semgrep_shim) travels end-to-end so a regex-tier finding can never ride correlation up to CRITICAL. - Transitive Python SCA — `poetry.lock` + `Pipfile.lock`. Both lockfiles are now parsed as the full resolved dependency closure, so a CVE three dependencies deep is caught — closing the
requirements.txt-only direct-deps gap. (Separate from the npmpackage-lock.jsontransitive tree shipped in v0.8.0.) - Released, signed, and shipped to production. v0.16.1 publishes a cosign-signed multi-arch Docker image with CycloneDX SBOM + SLSA provenance, and is live on the hosted platform. The GitHub Action is pinned via
uses: Fendix-app/Fendix@v1.
Enterprise-readiness complete — audit pass + CI stability
May 18, 2026
- Enterprise-readiness work complete. The full enterprise-readiness program shipped across the prior releases: trust fixes (v0.11.1), the unified SAST engine (v0.12.0), the REST API served by the backend SaaS layer (v0.12.1), offline mode plus i18n and PDF reports (v0.13.0), integrations (v0.13.1), and the benchmark harness, CI templates, and rule pack (v0.14.0). This patch closes the CI loop and locks in a stable state for the next feature cycle.
- CI red-state sweep. Resolved three pre-existing CI flakies: context-cancellation tests widened to 8s budget + EPIPE tolerance on plugin stdin writes (macOS-specific pipe close sequence); two hybrid-correlator E2E tests fixed by honouring the
FENDIX_ENGINEenv var so they opt into--python-enginecorrectly on CI runners; gofmt drift corrected across 21 files that had accumulated whitespace / import-ordering skew. All 21 Go packages race-clean, 180 Python tests green, 14 E2E tests green. - Pre-existing YAML quoting fix in `auth.yaml`. The
python-jwt-decode-no-verificationrule embedded{"verify_signature": False}unquoted — valid to Python's ruamel-yaml but rejected bygopkg.in/yaml.v3. A new YAML catalog test surfaced it; single-quoted in this patch. Behaviour unchanged at scan time. - Backend and frontend synced to v0.14.1. The backend absorbed all new CLI flags and schema fields. The frontend was updated with version literals, changelog entries, CLI reference (new subcommands + flags), checks page (textscan + expanded Semgrep), and integrations page (Jira + Slack/Teams + GitLab/CircleCI).
Enterprise benchmark harness + GitLab/CircleCI templates + Semgrep rule pack
May 18, 2026
- Enterprise SAST comparison harness.
scripts/benchmark-enterprise/provides an apples-to-apples comparison of fendix vs. semgrep vs. bandit on a shared ~100-LOC fixture with 5 labeled true positives and 5 false-positive probes. Measures wall-clock, peak RSS, TP count, and FP count. Tools not on PATH are honestly reported as 'skipped' — no silent zeros. A newbenchmark-enterprise.ymlGitHub Actions workflow runs on release tags andworkflow_dispatch, installs both competitors, and posts results as a job summary. - GitLab CI + CircleCI templates via `fendix init --ci`. The init command now auto-detects the CI system from project root files (
.github/,.gitlab-ci.yml,.circleci/) and emits a native CI template.--ci github(unchanged),--ci gitlab(.gitlab-ci.fendix.yml+ SAST report +NEXT-STEPS.md),--ci circleci(inline snippet +NEXT-STEPS.md). Without--ci, auto-detect falls back togithub. Every emitted YAML is parse-validated at test time so typos can't ship in a release. - Semgrep rule pack expanded 9 → 24 rules. A new crypto rule file adds 4 cryptography rules. Additions across existing files: 2 new auth rules (Django function-based view missing decorator, Flask route missing auth decorator), 5 new injection rules (Django ORM raw SQL, Flask
render_template_stringSSTI,subprocess(shell=True)high-precision variant,pickle.loads,yaml.loadwithout SafeLoader), 4 new secrets rules (GCP service-account JSON inline, AWS access-key ID, Slack webhook URL, PEM private key). Every rule carriesmetadata.category,metadata.fendix_severity,metadata.confidence,metadata.cwe. A new YAML-only catalog test enforces these invariants for every current and future rule.
Integrations: GitHub App + Jira + Slack/Teams
May 18, 2026
- GitHub App handler doc cleanup. The GitHub App webhook documentation now describes what's actually there:
HandlePullRequest(clone → scan → comment → SARIF upload),HandleCheckRun(re-run button),HandlePush(no-op baseline placeholder). - Jira integration via `fendix jira`. Idempotent Jira sync: each finding above
FENDIX_JIRA_MIN_SEVERITY(default HIGH) gets exactly one Jira issue. Idempotency key isfendix-id:<finding.ID>on the issue's label field — re-running the command on the same findings is safe. Severity → priority mapping: CRITICAL→Highest, HIGH→High, MEDIUM→Medium, LOW/INFO→Low. Configured via four environment variables (FENDIX_JIRA_URL,FENDIX_JIRA_PROJECT_KEY,FENDIX_JIRA_EMAIL,FENDIX_JIRA_API_TOKEN). Works against both Jira Cloud and Server tiers (plaintext description format, ADF rendering is server-side). - Slack + Teams webhook alerts via `fendix notify`. Post Slack Block Kit and Teams Adaptive Card alerts for findings above a configurable severity floor. Both sinks are optional — set
FENDIX_SLACK_WEBHOOK_URLand/orFENDIX_TEAMS_WEBHOOK_URL; whichever are set receive alerts.FENDIX_NOTIFY_MIN_SEVERITYcontrols the floor (default: CRITICAL).FENDIX_NOTIFY_DEDUP_WINDOW(Go duration, default 1h) prevents re-alerting the same finding ID within the window (in-memory; restart re-arms). Per-sink errors are isolated so a failing Teams endpoint doesn't block Slack delivery.
Offline mode + Arabic HTML + PDF executive report
May 18, 2026
- Air-gapped CVE database + `fendix db`. A JSON snapshot format (schema v1) for OSV advisory exports. Three management subcommands:
fendix db update --source <osv-export.json>ingests an OSV export into a local snapshot;fendix db list [--path]prints snapshot metadata;fendix db verify [--path]prints the SHA-256 for integrity checking. The v0.13 native dependency path gained--offlineand--offline-db <path>. Current v3.4.1 limitation:--codeauto-enables Python dependency tools that may still use the network; use--offline --python-engine=falsefor the native-only path or--offline --checks auth,injectionto omit Python dependency checks. - Arabic HTML report + i18n foundation.
fendix scanandfendix reportaccept--lang arto render an HTML report right-to-left with Arabic strings. Adding a new language is a single new constructor plus a switch case. JSON, SARIF, and PDF outputs stay English (machine-consumed; localisation would break downstream tooling). Unknown--langvalues fall back to English with a stderr warning. - PDF executive report via `--format pdf`. New PDF output format via
fendix scan --format pdfandfendix report --format pdf. Structure: cover page → executive summary with severity-counts table and top-3 findings → paginated findings table with severity-coloured cells → remediation plan (CRITICAL + HIGH only) → metadata appendix. New--classification <text>flag (defaultINTERNAL) renders a red classification banner at the top-right of every page; empty string disables the banner. Usesgithub.com/go-pdf/fpdf(MIT, pure Go, no CGo). Arabic PDF is deferred — fpdf's built-in fonts do not render Arabic glyphs.
v3.7.0 shipped October 2026 — the GitHub Action requires Semgrep for code scans and fails the job when it cannot run, installs wheels only and uploads SARIF only for a finished scan, and a fatal Semgrep run is recorded as failed; no report-schema, SARIF, fingerprint or decision-policy changes, and every exit code keeps its meaning. v3.6.5 shipped October 2026 — Semgrep 1.182.1, MCP 1.29.0 and golang.org/x/mod 0.40.0 fix the last fixable HIGH advisories in the official image, Semgrep no longer contacts semgrep.dev, and self-hosted Linux CI runners need glibc 2.34 or later for Semgrep; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.6.4 shipped October 2026 — rebuilt on Go 1.27.3 and certifi 2026.10.23, so TLS no longer trusts the eight compromised emSign intermediate CAs and a hostile HTTP/2 scan target can no longer burn the scanner's CPU; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.6.3 shipped October 2026 — four bundled Semgrep rules that never matched now report, WARN by default under the confidence-gated --fail-on; the Flask auth advice says the decorator goes below @app.route(...); eleven checks have static catalog copy; no finding-identity change. v3.6.2 shipped October 2026 — diff-aware scans with a relative --code scan the changed files again, and a diff scope that cannot be represented safely falls back to a full scan. v3.6.1 shipped October 2026 — SARIF for a scan with no findings is valid, and the GitHub Action verifies the release signature before it runs the binary. v3.6.0 shipped October 2026 — baselines, .fendix-ignore rules and SARIF act on each security occurrence, so a baselined or ignored test fixture can no longer hide a new production credential grouped with it; baseline format v2, one SARIF result per occurrence, and fendix jira and fendix verify track every occurrence. v3.5.1 shipped October 2026 — fendix init writes CI that installs a pinned, signature-verified Fendix, brew upgrade reaches installs older Homebrew recorded as version 64, and the installer can require a signature or a pinned SHA-256; no scanner, fingerprint, report-schema, decision-policy or exit-code changes. v3.5.0 shipped October 2026 — --fail-on refuses an invalid threshold instead of silently scanning with none, fendix verify no longer reads missing input as a fix, and images publish to Docker Hub; no fingerprint, report-schema or decision-policy changes. v3.4.1 shipped September 2026 — the engine images now ship Go 1.27, raising govulncheck's module ceiling from 1.25; no scanner, fingerprint or exit-code changes, and the Go module floor stays 1.25. v3.4.0 shipped September 2026 — a scan can no longer look complete when it wasn't: every analyzer records whether it ran and why not, the report carries a coverage block that names the gaps, a URL scan with zero endpoints writes its report instead of vanishing, and two opt-in flags turn a coverage gap into a failing build. v3.3.0 shipped September 2026 — an upgrade no longer splits a finding you were already tracking into a closed one and a new one, and the list of checks a scan ran is built from what completed rather than what was configured. v3.2.0 — every blocking decision explains itself. A BLOCK now carries the policy it was made under and the evidence class that justified it, all the way through Fendix's own storage into the SARIF you export, so a failed pipeline is answerable from the report alone. Findings held back say why, confidence scores come with the rules that produced them, and a build blocked only because confidence enforcement was switched off is labelled as such. v3.1.0 stopped findings claiming more than they proved — wildcard CORS with credentials, rate-limit prioritisation, response-aware header grading, path-traversal wording, test-fixture credentials and dependency applicability all became more precise. v3.0 gave findings a stable identity based on which rule fired, in which file, in which function, about which operation. Re-save your baselines once after upgrading from before v3.0, and rewrite any .fendix-ignore rule that pins a fingerprint: value — rules using the supported id, endpoint or category selectors are unaffected by the fingerprint change, although positional SEC-NNN ids are suitable only for short-lived triage.