What turns scanner output into reviewable evidence?
Evidence is an observation with provenance
Fendix keeps the source, location, analyzer, and relevant facts needed to review an observation. Technical identifiers such as CVE, CWE, paths, routes, and commit hashes remain intact so another person can trace the claim.
Correlation changes confidence, not history
Signals can corroborate the same condition across source, specification, runtime response, or imported SARIF. Correlation can raise confidence or expose contradictions. It does not erase the original observations.
A concrete example
A static analyzer reports an authorization risk on GET /users/{id}. A confirmed route and a runtime response that contradicts the authentication requirement are independent signals. Together they support a stronger disposition than an isolated pattern match.
What do I do with this?
Use Scanning overview to choose the inputs that can produce relevant evidence. Inspect the exact fields in Evidence and provenance, then continue to SARIF import, policy and confidence, or the Check Library.