When evidence is inconclusive, Fendix says so.
What the evidence can establish
A recorded verdict explains one scan under the policy and coverage saved with it. A comparison establishes observed changes subject to named limitations. Exact grouping establishes a shared remediation point or a potential relationship. Later comparable evidence can establish that a finding is no longer detected.
None of these establishes universal absence of vulnerabilities, a secure release, a proven shared causal origin, or that one change fixes every group member. Human approval, accepted risk, reported fixes and verified evidence remain different facts.
Evidence boundaries to check
Historical scans can lack coverage, policy or reliable fingerprint data. Missing values remain unknown; they are not filled with today’s policy. Deleted records and retention gaps cannot be reconstructed by the timeline.
Missing required analyzer coverage makes absence inconclusive. Sub-analyzer failures, scope narrowing, changed authentication or probing settings, truncation and suppression files also limit what the later scan could have reported. An engine change is a caveat: a changed analyzer can stop reporting a finding without a code fix.
Grouping uses stored exact keys, not generative AI or inferred upstream causality. A function name in another file is not proof of the same operation. Dependency fix guidance is per advisory and may be missing or inconsistent; no combined safe version is calculated.
A practical review before release
Read the recorded verdict and reasons. Check coverage and decision age. Inspect comparison factors before treating a change as progress. Review each grouped finding and advisory. Distinguish reported fixes from later-scan evidence. Re-run with comparable scope after remediation, and retain human release accountability.
Example: a team marks an issue fixed, but the newest completed scan has a required analyzer failure. The correct outcome is inconclusive verification, even if an older complete scan did not detect it. Restore coverage and collect a new comparable result.