Scanning overview

Choose inputs by the evidence you need

Black-box

--urlInspect a running API through HTTP without reading source.

White-box

--code and optional --specInspect source, dependencies, and declared routes.

Hybrid

--url --code --specCorrelate runtime, source, dependency, and specification evidence.

Run a passive first scan

Replace the target with an API you own or are authorized to test. Passive scanning is the default; destructive injection payloads remain off.

fendix scan \
  --url https://staging.example.com \
  --format html \
  --output report.html

Read findings and coverage together

Open the report and review finding dispositions, analyzer status, coverage gaps, and the release decision. A run can have zero blocking findings and still be INCOMPLETE when required evidence is missing.

Why does this work this way?

Read Evidence and correlation and Coverage. Continue to Authenticated scanning, or use the scan reference for every flag.