Skip to content
Fendix logo

Security Decision Record

A Security Decision Record is the written result of one release decision: which release it covers, the decision — PASS, WARN, BLOCK or INCOMPLETE — and its reasons, the evidence and required coverage it rests on, and the policy it was made under.

How records and accepted risk workHow a release decision is made

What a record answers

Which release does it cover?
The repository, commit and pipeline run the decision applies to.
What was decided, and why?
The decision, with the reason behind every blocking or held-back finding.
Was the required evidence there?
Which analyzers ran, which did not and why: the basis for INCOMPLETE.
Under which policy?
The policy version the decision was made under, so an old decision stays interpretable after the policy changes.

The record below is an illustrative sample with fictional data. In the hosted workspace, every decision is stored with its rationale. Immutable, hash-verifiable records tied to the commit, engine build and exact policy version are part of Managed CI, currently in limited availability.

What a defensible release decision contains.

See what changed, what was tested, which policies were triggered, and why the release received its decision.

Security decision record

Illustrative example — fictional data, not a customer record.
Release
payments-api
Version
2.14.0
Commit
9f3c1ab
Decided
Policy
.fendix.yaml v1, blocks at CRITICAL

Release decision

INCOMPLETE

Highest finding status

WARN

Decision reasons

  1. HIGH findings receive WARN under this illustrative policy, which blocks at CRITICAL. Severity alone is not the release recommendation.
  2. Dependency scan did not complete, so part of the release is undecided.
  3. 1 accepted risk expires in 11 days and has no fix in progress.

Tests and scanners

  • Static analysiscompleted
  • Secret scanningcompleted
  • API probingcompleted
  • Dependency scanfailed
  • Infrastructure confignot configured

Coverage gaps

  • Dependency scan failed — lockfile could not be resolved. Re-run before relying on this decision. Affects coverage.
  • Infrastructure config scanning is not configured for this repository. Not required by this policy.

Since previous release

  • 2 new
  • 1 fixed
  • 5 persisting

Accepted risks

Wildcard CORS configuration on /api/auth/login

Accepted by Security Lead, expires 2026-08-04

Assigned owners

  • Missing authentication on /api/users

    @platform-security, due 2026-08-07

  • Missing rate limit on /api/v2/login

    @platform-security, due 2026-08-07

Fix verification

  • 1 verified resolved
  • 1 still present
  • 1 queued

Human accountability

The release recommendation is not human approval. Review the evidence and coverage gaps, record risk acceptance and ownership, and request fix verification in your release process.

Audit trail
4 recorded events: policy evaluated, decision recorded, risk accepted, owner assigned.
  • BLOCK
  • WARN
  • INFO

See a record built from one of your releases

In a technical walkthrough we run Fendix against a target you nominate and go through the decision it produces with you.

Request a technical walkthrough