Privacy Policy

Data handling differs between the local engine, hosted platform, runners, and optional integrations. The sections below distinguish those workflows.

What the Fendix scanner collects

The CLI executes in the environment where you run it; optional analyzers may require external connections.
DAST sends requests to the authorized target. Dependency analyzers may query advisory and package services.
Local source analysis reads files from the filesystem. Hosted repository and report processing follow the hosted workflow instead.
No analytics, telemetry, or usage tracking is included in the open-source distribution.

When you request a technical walkthrough, we store the contact and company details you submit, your selected challenge, and any optional message.
We also store the page locale, campaign parameters, IP address, browser user agent, and request identifier for attribution, rate limiting, and spam prevention.
We use this information to respond to and manage your request. We do not add you to a newsletter or sell your information.
Operational providers, such as hosting and email delivery services, may process this information only to provide those services to Fendix.

Hosted target credentials can be stored encrypted while execution is queued and are removed from scan configuration at completion. Do not put secrets in messages or unrelated fields.
Detected credentials and the authentication values you supply are masked as [REDACTED] in scan reports (JSON, HTML, and SARIF output).
Dashboard sessions use authentication cookies. Scan-target credentials are separate from the user session.

Reports are generated locally and saved to the path you specify with --output.
HTML reports are self-contained single files with no external dependencies or tracking scripts.
Connected runners upload reports to the hosted platform. Hosted reports follow the retention period specified by the plan.

Active probes (e.g. injection, reflected XSS, open redirect, in-band SSRF, host-header injection, GraphQL introspection, HTTP method tampering) are always OFF by default.
Probes are capped per endpoint (20 by default, configurable) to prevent excessive traffic.
A legal disclaimer is shown in the terminal whenever --enable-active is used.
You are responsible for obtaining authorization before running active probes against any target.

The dependency CVE checker queries public advisory databases (PyPI, npm) to identify known vulnerabilities.
Semgrep runs locally — no source code is sent to Semgrep servers when using Fendix.
Local tool execution does not imply zero external traffic; network access depends on enabled analyzers and integrations.

Reports may be sent to GitHub, Jira, or notification destinations that you configure.
When a user asks the assistant (Fenn) something, their message, the recent conversation and, for a scan, its findings with short evidence excerpts are sent to the configured model provider. Known secret patterns are redacted from scan data first; messages are sent as written. Release-policy decisions are deterministic and do not depend on the assistant response.
The website keeps landing and campaign context in browser session storage to attribute contact requests to the page and campaign they came from.

On public marketing, documentation and demo pages, the website records page views and selected clicks (such as opening the demo or requesting a walkthrough) in Fendix's own database. Sign-in, account, workspace and scan pages are not measured.
Each record holds the page path, the language, the campaign parameters of the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content, utm_term), a referring-site category such as LinkedIn or X, and a random visit identifier.
The visit identifier is kept in your browser's local and session storage (not in a cookie) and is replaced after 30 minutes of inactivity. It is not linked to your name, email, account or form contents, and this measurement does not use device fingerprinting.
Your IP address and browser user agent are used only while each request is handled (rate limiting and recognising automated traffic) and are not stored with these records; like any request to our servers, they can appear in operational logs. No third-party analytics service receives this data.

For responsible disclosure of security vulnerabilities, see our Security Policy.

Last updated: October 2026. Confirm deployment and data-processing details before sharing sensitive data.