When should I enable active probes?
Active probes require explicit consent
Fendix keeps injection probes off by default. Enable them only on a target you are authorized to test, preferably a staging environment with monitored data and rollback available.
Bound the run
Start with a narrow target and explicit request and probe budgets. Authentication may expand the reachable surface, so confirm the test identity and environment first.
terminal
fendix scan \
--url https://staging.example.com \
--enable-active \
--max-probes-per-endpoint 10 \
--max-requests 1000Review evidence, not only exit status
Payload-validated evidence can become a strong confidence signal. Review the finding evidence and affected route before assigning remediation or changing policy.
Why does this work this way?
Read Policy and confidence. Exact safety flags and defaults are in the scan crawl and safety reference.