GuideStablev3.7.0

Getting started

Install Fendix, run a safe first scan, and understand the first release decision in 5–7 minutes.

On this page

In 5–7 minutes, you will install Fendix, scan an API you are allowed to test, and read the difference between a finding and a release decision.

Before you begin

Use macOS or Linux with a POSIX shell for this path.
Choose a development or staging API that you own or are explicitly authorized to test.
This first run uses passive checks. Active injection probes stay off.

The URL below is a placeholder. Replace https://staging.example.com before running the scan.

Install Fendix

The stable one-command path downloads the current release, verifies its SHA-256 checksum, and installs the binary on PATH.

terminal

curl -fsSL https://get.fendix.dev/install.sh | sh
fendix version

Run your first scan

Point Fendix at the authorized target. The command writes an HTML report you can keep and review.

terminal

fendix scan \
  --url https://staging.example.com \
  --format html \
  --output report.html

Open the result

Open report.html in a browser. Start with the release decision, then review coverage and each finding’s evidence. The terminal exit code is useful for automation, but the report explains why the run reached that outcome.

terminal

open report.html        # macOS
xdg-open report.html    # Linux

Understand the finding

Use this compact scenario to read the model. It is illustrative; your report will reflect the evidence from your target.

Finding: SEC-001An observed security condition with its own evidence and provenance.
Severity: HIGHThe potential impact if the condition is real.
Disposition: WARNThe current evidence does not justify blocking under the enforced finding policy.

HIGH does not automatically mean BLOCK. Severity, confidence, evidence, and policy answer different questions. WARN also does not mean PASS.

Understand the release decision

Now add coverage. The release policy requires SCA, but the required dependency evidence was not delivered. The finding stays HIGH → WARN; the separate coverage fact makes the release decision INCOMPLETE.

INCOMPLETE means the required evidence or coverage is missing. It is not another finding and does not mean the scan process crashed. Continue with The Fendix decision model, Findings and release decisions, and Coverage.

Optional: add CI

Before provider YAML, decide the threshold, required coverage, and which report CI must preserve. A blocking finding exits 1; an unfulfilled scan or strict coverage contract exits 2.

terminal

fendix scan --code . --fail-on HIGH --format sarif --output results.sarif

Choose your next step

Understand the system: The Fendix decision model.
Scan source or combine inputs: Scanning overview.
Scan protected routes: Authenticated scanning.
Make missing evidence fail closed: Require coverage.
Set a repository default: Configure release policy.
Look up exact syntax: CLI reference.