Trust center
What Fendix does with your code and data, how its releases are built and verified, and how to report a security issue. Everything here can be checked; what we cannot show yet is listed as such.
Where it runs and what it keeps
Open-source CLI
Runs on your machines or CI runners under the MIT license, with no account and no telemetry. Source code is analysed where it runs and is not uploaded. Network traffic goes to the targets you scan and, for dependency checks, to vulnerability and module services such as OSV.dev and the Go vulnerability database, which receive package names and versions. Offline behaviour depends on the analyzers a scan enables. --offline checks native PyPI and npm dependencies against a local snapshot and skips govulncheck, but in v3.7.0 the Python dependency check that a code scan enables does not receive the flag and may run networked tools unless you add --python-engine=false or --checks auth,injection. Out-of-tree plugins you install can make their own connections; --no-plugins skips them.
Hosted workspace
Repository scans use a shallow clone in a temporary directory that is removed after the scan. Target credentials you supply are stored encrypted and removed from the scan when the engine finishes it; a scan that fails before the engine reports keeps the encrypted value until the scan is purged, and a scheduled scan keeps its encrypted credentials while the schedule exists. Credentials found by the secret scanners are redacted when they are captured. Scan history is kept for your plan's retention period (7 to 365 days).
Customer-hosted runners
On Enterprise plans, scans run on runners inside your network. The workspace sends a runner the scan configuration, including any target credentials, and the runner returns the scan report (findings, evidence excerpts and coverage) and status heartbeats. Your source tree is not uploaded.
AI and your data
Release decisions are deterministic: no AI model takes part in detecting findings, scoring confidence or deciding PASS, WARN, BLOCK or INCOMPLETE.
The hosted workspace's optional assistant, Fenn, runs only when a user asks it something or requests a report. It then sends the user's message, the recent conversation and, for a conversation about a scan, that scan's target and findings (titles, locations, suggested fixes and short evidence excerpts, which can quote the matched source line) to the configured third-party language-model provider. Known credential and secret patterns are redacted from the scan context before it is sent. Redaction is pattern-based, so it is not a guarantee that no sensitive text reaches the provider, and messages users type are sent as written. Fenn never receives the repository and cannot change a decision or code.
Release integrity
- Release binaries, Linux packages, SBOMs and container images are signed with Sigstore cosign keyless signing. The release pipeline refuses to publish an unsigned tag unless a maintainer deliberately overrides that check. Every release from v0.6.0-rc2 to the current one carries signatures; the earliest releases (v0.2.0 to v0.6.0-rc1) shipped SHA-256 checksums only. Git tags are annotated but not signed, so verify the artifacts rather than the tag.
- Current releases ship signed CycloneDX and SPDX SBOMs for each binary (CycloneDX for each Linux package) and a SLSA v1.0 provenance attestation for each binary, generated and signed by the release workflow itself. SBOMs and provenance have shipped since v0.14.0.
- The installer checks the SHA-256 checksum by default and verifies the cosign signature when cosign is installed; FENDIX_REQUIRE_SIGNATURE=1 makes it refuse to install without a verified signature.
- Docker images are published to Docker Hub and can be pinned by digest.
Access control in the hosted workspace
- Organizations with owner, admin, member and viewer roles.
- Time-based one-time-password MFA, which an organization can require for its members.
- Scoped API keys that publish CI scans to your workspace and authenticate other supported integrations. The workspace's backend is not a public developer API.
- An append-only audit log of workspace actions, exportable as CSV.
- Release exceptions approved by someone other than the requester, bound to the evidence they were granted on.
Vulnerability disclosure
Report privately through GitHub. We acknowledge within 72 hours and triage within 7 days.
Compliance boundary
Fendix produces technical evidence for your security and compliance processes. Fendix holds no third-party security certification (such as SOC 2 or ISO 27001), and it does not certify your compliance with any standard or regulation, including NCA and SAMA frameworks.
Not yet published
A data processing agreement, a subprocessor list, data-residency commitments and a support SLA are not published yet. If your review needs them, ask us and we will tell you what we can provide.
Contact us