Live API Security Testing (DAST)
Black-box checks that send real HTTP requests to your API.
Authentication & Access Control
- Detects API endpoints accessible without any authentication
- Tests for JWT token validation bypasses (malformed tokens, expired tokens, unsigned tokens)
- Detects broken access control where one user can access another user's data (IDOR)
Browser Security (CORS)
- Detects misconfigured cross-origin policies that allow any website to make requests to the API
- Identifies configurations that could enable credential theft from browsers
Security Headers
- Checks for missing HTTPS enforcement (HSTS)
- Checks for missing clickjacking protection (X-Frame-Options)
- Checks for missing Content Security Policy
- Detects server version information leakage
Sensitive Data Exposure
- Detects passwords, API keys, and tokens returned in API responses
- Detects stack traces and internal error messages exposed to users
- Detects internal IP addresses leaked in responses
Rate Limiting
- Detects endpoints with no rate limiting, vulnerable to brute-force attacks
Cookie Flags
Passive — runs without --enable-active- Detects cookies missing the Secure attribute, allowing transmission over plaintext HTTP (CWE-614)
- Detects cookies missing HttpOnly, leaving them readable by client-side JavaScript (CWE-1004)
- Detects cookies missing SameSite, widening the CSRF surface (CWE-1275)
Active Injection Probes
Requires --enable-active flag — the active probe set spans 9 checks- SQL injection probes: time-based blind, error-based signatures, boolean comparison (MySQL, Postgres, MSSQL, SQLite, Oracle)
- Command injection via safe echo canary detection
- CRLF header injection via %0d%0a Set-Cookie probe
- Reflected XSS — payload reflected unescaped into the response (CWE-79)
- Open redirect — user-controlled redirect target (CWE-601)
- In-band SSRF — server-side request forgery confirmed in the response body (CWE-918)
- Host-header injection — poisoned Host / X-Forwarded-Host reflected into links or redirects (CWE-644/601)
- GraphQL introspection — schema introspection left enabled (CWE-200)
- HTTP method tampering — unsafe or override methods accepted (CWE-650/693/285)
Source Code Security Analysis (SAST and SCA)
White-box analysis runs locally. Native dependency checks may query OSV.dev, vuln.go.dev, and module registries. --offline constrains that native path, but in v3.7.0 the auto-enabled Python dependency tools may still use the network; add --python-engine=false or --checks auth,injection.
Hardcoded Secrets
- AWS access keys and secret keys
- Private cryptographic keys
- API tokens and passwords embedded in code
- Database connection strings with credentials
- JWT tokens committed to source control
Injection Vulnerabilities
- SQL injection via string formatting (Python and JavaScript)
- Command injection via shell execution
- Code injection via eval/exec with user input
- Cross-site scripting (XSS) via innerHTML and document.write
Vulnerable Dependencies (SCA)
- Scans Python (requirements.txt), JavaScript (package.json), and Go (go.mod) dependencies
- Transitive SCA: parses poetry.lock and Pipfile.lock as the full resolved dependency closure, catching CVEs in indirect dependencies that the requirements.txt-only path misses (v0.16+)
- Native defaults use govulncheck/vuln.go.dev for Go and OSV.dev clients for pinned PyPI/npm packages; pip-audit is opt-in with --use-pip-audit
- For native checks, --offline uses the local snapshot for PyPI/npm and records govulncheck as skipped. In v3.7.0, also disable Python or omit its dependency check to prevent Python dependency tools from using the network
- Flags unpinned dependency versions
API Specification Analysis
- Detects endpoints with no authentication requirement in OpenAPI specs
- Detects use of insecure HTTP instead of HTTPS
- Detects weak authentication schemes (HTTP Basic Auth)
- Identifies explicitly public endpoints that may need review
Framework-Specific Checks
- Flask routes missing login protection
- Django views missing authentication mixins
- FastAPI routes missing auth dependencies
- JWT token decoding without signature verification
- Proven Path v1: route-table extraction binds a request route to its handler and exports the full route → handler → source → sink taint chain as SARIF codeFlows, with a source_tier provenance tag (v0.16+)
Key Differentiators
Code and runtime evidence
Live API testing and static code analysis report into one evidence model. Agreement between them is one corroborating signal among several, not a requirement.
Discovery from a URL or spec
Point it at a URL or an OpenAPI spec and it discovers endpoints. The release policy itself is committed separately in .fendix.yaml.
Developer-first
Runs on every commit, not just in CI. `fendix hook install` wires a staged diff scan as a pre-commit gate; in v3.7.0 add `--python-engine=false` to guarantee the native-only fast path.
Safe by default
Active/destructive tests are disabled unless explicitly enabled
Single report
Both API and code findings in one unified output
No external dependencies
HTML reports are fully self-contained, no internet required to view
Reporting & Integration
Multiple output formats, CI/CD gating, and credential safety built in.
Output Formats
- JSON — machine-readable for integration with other tools
- HTML — self-contained visual report with severity badges and expandable finding details
- SARIF 2.1.0 — compatible with GitHub Code Scanning and Azure DevOps
Safety & Classification
- Five severity levels: Critical, High, Medium, Low, Info
- Checks assign intrinsic severity; verified correlation or reachability can escalate it, and confidence caps the finalized severity before policy evaluates it
- Findings carry a stable identity built from rule, file, symbol and vulnerable operation — it survives edits above them, reformatting and re-wording, so baselines and suppressions keep matching
- SARIF states the rule's severity, Fendix's confidence in that instance, and the two combined separately — an alert never implies more risk than Fendix assigns it
- Detected credential material is redacted at capture time as [REDACTED len=N sha256:…] — the value itself never enters a report
- Baseline diffing to show only new findings between scans