What's new
A version-by-version history of Fendix development. v3.4.1 shipped September 2026 — the engine images now ship Go 1.27, raising govulncheck's module ceiling from 1.25; no scanner, fingerprint or exit-code changes, and the Go module floor stays 1.25. v3.4.0 — a scan can no longer look complete when it wasn't: every analyzer records whether it ran and why not, the report carries a coverage block that names the gaps, a URL scan with zero endpoints writes its report instead of vanishing, and two opt-in flags turn a coverage gap into a failing build. v3.3.0 — an upgrade no longer splits a finding you were already tracking into a closed one and a new one, and the list of checks a scan ran is built from what completed rather than what was configured. v3.2.0 — every blocking decision explains itself. A BLOCK now carries the policy it was made under and the evidence class that justified it, all the way through Fendix's own storage into the SARIF you export, so a failed pipeline is answerable from the report alone. Findings held back state why they were held back, confidence scores come with the rules that produced them, and a build blocked only because confidence enforcement was switched off is labelled as such. v3.1.0 stopped findings claiming more than they proved — wildcard CORS with credentials, rate-limit prioritisation, response-aware header grading, path-traversal wording, test-fixture credentials and dependency applicability all became more precise. v3.0 gave findings a stable identity based on rule, file, symbol and operation rather than line number; re-save your baselines once after upgrading from before it.
Distribution
April 2026
- Python engine embedded into Go binary via go:embed
- Auto-extraction to ~/.fendix/engine/ on first run with version stamp
- Graceful fallback if Python not installed (whitebox skipped with clear message)
- GitHub Actions release workflow: linux/amd64, darwin/amd64, darwin/arm64
- Multi-stage Dockerfile with non-root user
- curl-pipe installer with platform detection and sha256 verification
- Homebrew formula (brew tap fendix/tap && brew install fendix)
Reporting & CI/CD
April 2026
- JSON reporter with full scan metadata (mode, endpoints, source counts)
- Self-contained HTML report with JS sorting, expand/collapse, print CSS
- SARIF 2.1.0 reporter — GitHub Code Scanning compatible
- fendix report command — re-render JSON to HTML/SARIF without re-scanning
- Baseline diff mode: --baseline and --save-baseline for PR workflows
- CI/CD integration docs with GitHub Actions examples
Active Scanner
March 2026
- Safe probe framework with audit log and legal disclaimer
- Time-based blind SQL injection detection (MySQL, PostgreSQL, MSSQL)
- Command injection canary detection with safe echo payloads
- CRLF header injection probes
- Per-endpoint probe rate limiter (max 20 probes/endpoint)
- --enable-active gate ensures probes never run by default
Hybrid Engine & Orchestration
March 2026
- Go subprocess spawner for Python engine with full IPC
- Streaming Finding reader with malformed-line resilience
- Correlator: endpoint normalization, fuzzy matching, severity escalation
- .fendix-ignore suppression with YAML rules and expiry dates
- Baseline diff for tracking new vs. existing findings
- --fail-on exit code logic for CI/CD gates
Auth Scanner
March 2026
- AuthContext model with multi-source credential resolution
- Unauthenticated access detection on protected endpoints
- JWT bypass checks: none algorithm, expired token, signature strip
- IDOR two-account access control verification
- Credential masking ([REDACTED]) in all report formats
- ~/.fendix/profiles/ persistent config system
White-Box Engine
March 2026
- Python engine.py with full IPC contract and error handling
- Secrets analyzer: 7 pattern types (AWS, PEM, API key, JWT, DB URI, etc.)
- OpenAPI spec parser for 2.0 and 3.x with 4 auth checks
- Semgrep rules for auth, injection, and secrets
- AST analyzer for Python and JavaScript code patterns
- Dependency CVE checker via pip-audit and npm audit
Passive Scanner & Reporting
February 2026
- Endpoint crawler with spec parsing, JS discovery, and brute-force
- Security headers, CORS, data exposure, and rate limit checks
- Worker pool concurrency model
- JSON reporter with scan metadata
- Self-contained HTML reporter with color-coded severity
- Orchestrator wiring for all passive checks
Foundation
February 2026
- Go module and Python package initialization
- Finding, ScanConfig, and severity scoring models
- Cobra CLI skeleton with version command
- GitHub Actions CI workflow
- Makefile for build, test, lint, and clean
- ADR-001 and ADR-002 architecture decision records
v3.4.1 shipped September 2026 — the engine images now ship Go 1.27, raising govulncheck's module ceiling from 1.25; no scanner, fingerprint or exit-code changes, and the Go module floor stays 1.25. v3.4.0 shipped September 2026 — a scan can no longer look complete when it wasn't: every analyzer records whether it ran and why not, the report carries a coverage block that names the gaps, a URL scan with zero endpoints writes its report instead of vanishing, and two opt-in flags turn a coverage gap into a failing build. v3.3.0 shipped September 2026 — an upgrade no longer splits a finding you were already tracking into a closed one and a new one, and the list of checks a scan ran is built from what completed rather than what was configured. v3.2.0 — every blocking decision explains itself. A BLOCK now carries the policy it was made under and the evidence class that justified it, all the way through Fendix's own storage into the SARIF you export, so a failed pipeline is answerable from the report alone. Findings held back say why, confidence scores come with the rules that produced them, and a build blocked only because confidence enforcement was switched off is labelled as such. v3.1.0 stopped findings claiming more than they proved — wildcard CORS with credentials, rate-limit prioritisation, response-aware header grading, path-traversal wording, test-fixture credentials and dependency applicability all became more precise. v3.0 gave findings a stable identity based on which rule fired, in which file, in which function, about which operation. Re-save your baselines once after upgrading from before v3.0, and rewrite any .fendix-ignore rule that pins a fingerprint: value — rules matching by path, category or rule id are unaffected.