A 14-day managed pilot on a release that matters

What happens over 14 days

The 14-day pilot starts after payment and completion of the agreed prerequisites. Exact dates and deliverables are set in the written quote.

1. Days 1–2

   Scope and policy

   Choose the repository and, where applicable, the staging API. Agree the release policy and the success criteria, and confirm access and terms.

2. Days 3–5

   Integration and first evidence

   Configure Fendix in your pipeline or run it together, produce the first decision, and check which required evidence actually arrived.

3. Days 6–9

   Decisions and tuning

   Review each decision, coverage gap and piece of evidence; adjust thresholds and required evidence where the policy did not match your intent; record any accepted risks.

4. Days 10–12

   Fix verification

   Re-test selected critical fixes where supported, and confirm whether remediation changed the decision.

5. Day 13

   Review

   Walk through the results with your stakeholders against the success criteria agreed on day one.

6. Day 14

   Outcome

   Receive the reviewed decision record, the explicit coverage gaps and a next-step recommendation.

Your code, your data, your environments

Is source code required?

Only for code, dependency and secrets evidence. API testing needs nothing but a reachable staging URL, so the pilot can be scoped to the evidence you want to evaluate.

Can execution stay inside our environment?

Yes. The open-source CLI runs on your machines or CI runners with no account and no telemetry, and your source code is not uploaded. What leaves your environment is the reports you choose to share and, for dependency checks, package names and versions sent to public vulnerability and module services. Offline behaviour depends on the analyzers a scan enables. --offline checks native PyPI and npm dependencies against a local snapshot and skips govulncheck, but in v3.7.0 the Python dependency check that a code scan enables does not receive the flag and may run networked tools unless you add --python-engine=false or --checks auth,injection. Out-of-tree plugins you install can make their own connections; --no-plugins skips them.

Does Fendix keep our code?

When scans run in your environment, the repository is not uploaded; what you share is the report, whose evidence excerpts can quote individual source lines. When the hosted workspace scans a repository, it makes a shallow clone in a temporary directory and removes it after the scan; findings and reports are kept for the workspace's retention period.

Will production be touched?

No. The pilot targets the staging API you nominate. Active probes that send attack payloads run only when explicitly enabled, and only against targets you authorize.

What terms apply?

This is a paid 14-day pilot. After a scoping session, we send a written quote covering one repository, one release and an agreed staging/API target. You approve the scope and price before payment. The pilot starts once payment and the agreed prerequisites are complete. Any continuing subscription is agreed separately; the pilot does not guarantee a PASS decision. Confidentiality and data-processing terms are agreed before access; standard NDA and DPA templates are not currently published.