Authenticated scanning

Use a scoped test identity

• Use a non-production account with the least privileges needed for the test.
• Store credentials in CI secrets or a local auth profile; never commit them to .fendix.yaml.
• Run against an environment you own or are explicitly authorized to test.

Create a local auth profile

Reference the profile from .fendix.yaml with auth.profile: ci, or pass --profile ci. Environment variables resolve at scan time.

# ~/.fendix/profiles/ci.yaml — do not commit
auth:
  type: bearer
  value: ${FENDIX_CI_TOKEN}

Run and verify

Review the report for authentication-related scanner status and route evidence. A successful command alone does not prove protected routes were covered.

fendix scan --url https://staging.example.com --profile ci

Why does this work this way?

Credentials are runtime inputs, while policy stays reviewable in source control. Read Evidence and correlation. Exact --auth, --auth-type, --auth-header, profile, and environment behavior is in the authentication reference.