Skip to content
Demo data.
Sign up to scan your APIs
Fendix logo
Back to scans

https://payments.example.com

Completed

Jul 24, 2026, 09:12 AM · 4.5s · hybrid mode

Release decision

INCOMPLETE

Required coverage is incomplete, so a pass or warn cannot be justified.

Coverage
Required coverage incomplete
Policy
2.0.0
Scanned
Jul 24, 2026, 09:12 AM
Decided
Jul 24, 2026, 09:12 AM(today)

Coverage gap

  • pipDependency scanRequired

    Delivered no evidence: a network error stopped it.

    lockfile could not be resolved

    Fendix owns this gap. Re-run the scan; a network error is usually transient.

Next steps

A release decision is a recommendation, not an approval. Your team stays accountable for the release.

Coverage

7 findings

Sample data
Finding decision
Severity

Each finding has its own decision. The release decision above is made once, for the whole scan.

SEC-001HIGHFinding decision: WARNCorrelatedMissing authentication on /api/users endpoint

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: HIGH

Evidence

Illustrative JSON response contains synthetic user records without authorization; a random control path returns 404. Static analysis confirms no auth decorator on the route handler.

Remediation

Require Bearer token. Return 401 for unauthenticated requests. Add @requires_auth decorator to the route.

Location: src/routes/users.py:42References: CWE-306, OWASP-A01
SEC-002HIGHFinding decision: WARNBlack-boxWildcard CORS configuration requires review

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: HIGH

Evidence

Illustrative response: wildcard origin and credentials enabled. Browsers reject this combination for credentialed reads; this alone does not prove data exposure.

Remediation

Never combine wildcard CORS origin with credentials. Specify an explicit allowlist of trusted origins.

References: CWE-942, OWASP-A05
SEC-003HIGHFinding decision: WARNWhite-boxHardcoded AWS access key in source

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: HIGH

Evidence

[REDACTED len=20 sha256:3f1c9a…] found at line 18: matches the AWS access key pattern.

Remediation

Remove the key immediately and rotate it in AWS IAM. Use environment variables or a secrets manager.

Location: config/settings.py:18References: CWE-798
SEC-004MEDIUMFinding decision: WARNBlack-boxMissing Content-Security-Policy header+2 more

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: HIGH

Affected endpoints (3)

GET /health
GET /api/v3/user
GET /api/v3/store/inventory

Evidence

Content-Security-Policy header absent from all responses.

Remediation

Add a Content-Security-Policy header. Start with: default-src 'self'

References: CWE-693
SEC-005MEDIUMFinding decision: WARNBlack-boxServer version disclosed in response

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: MEDIUM

Evidence

Server: nginx/1.18.0 disclosed in response headers.

Remediation

Configure your reverse proxy to omit or mask the Server header.

References: CWE-200
SEC-006MEDIUMFinding decision: WARNBlack-boxNo rate limiting on authentication endpoint

Finding decisionWARNConfidence-gated policy

Actionable, and below the fail-on threshold.

Engine reason: actionable finding below the --fail-on threshold

Confidence: MEDIUM

Evidence

Sent 50 requests in 5s — all returned HTTP 200 with no throttling or 429 response.

Remediation

Implement rate limiting on auth endpoints. Recommended: 5 attempts per minute per IP.

References: CWE-307, OWASP-A07
SEC-007LOWFinding decision: INFOBlack-boxInternal IP address in error response

Finding decisionINFOConfidence-gated policy

Informational: the policy asks for no action.

Engine reason: informational finding

Confidence: LOW

Evidence

Response body contains: "upstream: 10.0.1.42:5432"

Remediation

Sanitize error messages before returning them to clients. Never expose internal network topology.

References: CWE-209