Skip to content
FendixDocumentationDocs

.fendix.yaml · SEC-001 · SARIF

Current release v3.7.0
Browse docs

.fendix.yaml · SEC-001 · SARIF

ConceptStablev3.7.0

The Fendix decision model

How security inputs become an explainable release decision and a durable record.

On this page

How does Fendix turn scanner output into a release decision?

The mental model

Fendix keeps observation, interpretation, and release policy separate. A scanner contributes evidence. Correlation strengthens or challenges that evidence. Finding policy assigns a disposition to each finding. Release policy then evaluates those dispositions together with coverage.

  1. 01Security inputs
  2. 02Evidence
  3. 03Correlation
  4. 04Finding disposition
  5. 05Release decision
  6. 06Required action
  7. 07Security Decision Record

One decision, two independent facts

In this illustrative scenario, SEC-001 has intrinsic severity HIGH, but the available evidence supports disposition WARN. The release also requires SCA, and that coverage is missing. The resulting release decision is INCOMPLETE.

Finding
HIGH → WARNSeverity describes impact; evidence and confidence determine the disposition.
Coverage
SCA missingRequired dependency evidence was not delivered for this run.
Release
INCOMPLETEThe release cannot be called complete while required evidence is absent.

What each layer can say

  • Evidence records what an analyzer observed and where it came from.
  • A finding disposition is BLOCK, WARN, or INFO; it applies to one finding.
  • A release decision is BLOCK, INCOMPLETE, WARN, or PASS; it applies to the release candidate.
  • A Security Decision Record preserves the decision, policy versions, coverage state, and supporting evidence for review.

What do I do with this?

Continue with findings and release decisions, then learn how coverage can make a release incomplete. To change the threshold, use Configure release policy. Exact flags live in the scan reference.