Separate confirmed shared remediation points, potential relationships and ungrouped findings.
Investigate a shared remediation point
On a completed scan, switch Individual findings to Grouped by remediation point. Expand a group to see its members, evidence, analyzers, investigation focus and limitations. Grouping connects distinct findings; deduplication asks whether observations are the same finding.
A confirmed group establishes a shared remediation point, such as one package declaration. It does not prove a common causal origin or promise that one fix resolves every member. Potentially related means investigate together while preserving separate findings. Ungrouped means no supported relationship was established.
Exact evidence rules
Dependency: identical ecosystem, package, installed version and manifest, all present, establish a confirmed shared declaration.
Code location: identical file, line and weakness category can group code findings. It is confirmed only when every member names the same operation; missing or different operations make it potential. This rule excludes dependencies, credentials and infrastructure configuration.
Potential relationships: different weakness categories on one line; the same file, function and category; credentials in one file; infrastructure findings in one configuration file; or the same ecosystem and package in separate declarations.
Rules run in precedence order using exact stored evidence. A finding belongs to at most one group. Groups do not grow through chains of similarity, shared severity or a confidence percentage. No generative AI determines these classifications.
Example: two advisories, one declaration
Two advisories name the same package version in requirements.txt. The declaration is a confirmed shared remediation point. Review each advisory: they may list different fixed versions, no fix, or evidence against applicability. Fendix does not compute one safe version across advisories.
Black-box findings are not grouped: a shared URL does not identify one configuration change. Stored intra-function evidence cannot establish a shared upstream helper across functions. Rotate each exposed credential even when its file is shared.