The current strict .fendix.yaml schema version is 1. Unknown fields and unsupported future versions are rejected.
Minimal valid configuration
.fendix.yaml
version: 1Common release policy
.fendix.yaml
version: 1
fail_on: HIGH
ignore_path: .fendix-ignore
scan:
enforce_confidence: true
deescalate_tests: truePrecedence
Fendix applies defaults, then values present in .fendix.yaml, then only CLI flags explicitly supplied by the caller. An unchanged CLI default does not overwrite the file.
defaults→.fendix.yaml→explicit CLI flags
Top-level fields
Scroll horizontally to inspect every field.
| Field | Type | Default | Requirement | Allowed values | CLI | Description |
|---|---|---|---|---|---|---|
version | integer | 1 | Required | 1 | — | Required configuration schema version. |
fail_on | string | — | Optional | CRITICAL · HIGH · MEDIUM · LOW · empty | --fail-on | Severity threshold considered by the finding policy. |
ignore_path | string | — | Optional | — | --ignore | Repository ignore-file path. |
scan fields
Scroll horizontally to inspect every field.
| Field | Type | Default | Requirement | Allowed values | CLI | Description |
|---|---|---|---|---|---|---|
scan.deescalate_tests | boolean | true | Optional | — | --deescalate-tests | Treat unsupported test-code findings as informational while preserving evidence. |
scan.delay_ms | integer | 100 | Optional | — | --delay | Delay between HTTP requests in milliseconds. |
scan.enable_active | boolean | false | Optional | — | --enable-active | Explicitly permit active injection probes. |
scan.enforce_confidence | boolean | true | Optional | — | --enforce-confidence | Require confidence and evidence support before BLOCK. |
scan.format | string | json | Optional | json · html · sarif · pdf | --format | Default report format. |
scan.timeout | integer | 10 | Optional | — | --timeout | HTTP timeout in seconds. |
scan.workers | integer | 10 | Optional | — | --workers | Concurrent HTTP worker count. |
crawler fields
Scroll horizontally to inspect every field.
| Field | Type | Default | Requirement | Allowed values | CLI | Description |
|---|---|---|---|---|---|---|
crawler.crawl_depth | integer | 1 | Optional | — | --crawl-depth | Recursive HTML link depth. |
crawler.max_endpoints | integer | 500 | Optional | — | --max-endpoints | Maximum discovered endpoints. |
crawler.respect_robots | boolean | false | Optional | — | --respect-robots | Enforce robots.txt Disallow directives. |
crawler.wordlist_path | string | — | Optional | — | --wordlist | Custom discovery wordlist path. |
budgets fields
Scroll horizontally to inspect every field.
| Field | Type | Default | Requirement | Allowed values | CLI | Description |
|---|---|---|---|---|---|---|
budgets.max_duration | duration | 0s | Optional | — | --max-duration | Soft cap for total scan duration. |
budgets.max_requests | integer | 0 | Optional | — | --max-requests | Soft cap for total HTTP requests. |
auth fields
Scroll horizontally to inspect every field.
| Field | Type | Default | Requirement | Allowed values | CLI | Description |
|---|---|---|---|---|---|---|
auth.profile | string | — | Optional | — | --profile | Name of a local authentication profile; no secret is stored in repository policy. |
Validation behavior
- version is required, must be positive, and cannot exceed 1.
- Unknown fields fail parsing; spelling mistakes are never ignored silently.
- A future schema version fails loudly so an older binary cannot misread policy.
Stable CLI-only capabilities
These stable controls cannot currently be committed to .fendix.yaml. Pass them explicitly in the invocation or CI configuration.
| Capability | CLI options |
|---|---|
| Coverage gates | --fail-on-coverage-gap, --require-analyzers |
| Applicability policy | --block-on-inapplicable |
| Offline scanning | --offline, --offline-db |
| Diff and staged scope | --diff, --staged, --fast |
| Analyzer selection | --checks, --python-engine, --no-native-deps |
| Imports and plugins | --import, --no-plugins, --allow-repo-local-plugins |