Privacy Policy

Data handling differs between the local engine, hosted platform, runners, and optional integrations. The sections below distinguish those workflows.

What the Fendix scanner collects

The CLI executes in the environment where you run it; optional analyzers may require external connections.
DAST sends requests to the authorized target. Dependency analyzers may query advisory and package services.
Local source analysis reads files from the filesystem. Hosted repository and report processing follow the hosted workflow instead.
No analytics, telemetry, or usage tracking is included in the open-source distribution.

When you request a technical walkthrough, we store the contact and company details you submit, your selected challenge, and any optional message.
We also store the page locale, campaign parameters, IP address, browser user agent, and request identifier for attribution, rate limiting, and spam prevention.
We use this information to respond to and manage your request. We do not add you to a newsletter or sell your information.
Operational providers, such as hosting and email delivery services, may process this information only to provide those services to Fendix.

Hosted target credentials can be stored encrypted while execution is queued and are removed from scan configuration at completion. Do not put secrets in messages or unrelated fields.
All credentials are masked as [REDACTED] in scan reports (JSON, HTML, and SARIF output).
Dashboard sessions use authentication cookies. Scan-target credentials are separate from the user session.

Reports are generated locally and saved to the path you specify with --output.
HTML reports are self-contained single files with no external dependencies or tracking scripts.
Connected runners upload reports to the hosted platform. Hosted reports follow the retention period specified by the plan.

Active probes (e.g. injection, reflected XSS, open redirect, in-band SSRF, host-header injection, GraphQL introspection, HTTP method tampering) are always OFF by default.
Probes are rate-limited to a maximum of 20 per endpoint to prevent excessive traffic.
A legal disclaimer is shown in the terminal whenever --enable-active is used.
You are responsible for obtaining authorization before running active probes against any target.

The dependency CVE checker queries public advisory databases (PyPI, npm) to identify known vulnerabilities.
Semgrep runs locally — no source code is sent to Semgrep servers when using Fendix.
Local tool execution does not imply zero external traffic; network access depends on enabled analyzers and integrations.

Reports may be sent to GitHub, Jira, or notification destinations that you configure.
The assistant uses the configured model provider to process conversation context. Release-policy decisions are deterministic and do not depend on the assistant response.
The website retains landing and campaign context in browser session storage for contact attribution, and logs limited interaction events without form fields.

For responsible disclosure of security vulnerabilities, see our Security Policy.

Last updated: September 2026. Confirm deployment and data-processing details before sharing sensitive data.