Release decision
INCOMPLETE
- Why
- Required SCA evidence is missing.
- Finding
- HIGH severity; WARN finding status.HIGH→WARN
- Release
- payments-api
- Finding ID
- SEC-001
- Release policy
- .fendix.yaml v1
Application security decision platform
Know whether this release meets your security bar, and why.
Fendix connects security evidence, required coverage, and release policy into one explainable decision your team can act on.
Works with
Latest release v3.7.0- GitHub Actions
- GitLab CI
- CircleCI
- Jira
More security alerts don't create better release decisions.
Engineering teams already receive findings from SAST, SCA, DAST, and penetration tests. The hard part is knowing what is reachable, what violates policy, who owns the fix, and whether the release can move forward.
What you already have
- SAST code scanners
- SCA dependency tools
- DAST API tests
- Penetration tests
What the findings alone don't answer
- Which of these is actually reachable?
- Which of these violates our policy?
- Who owns the fix, and by when?
- Can this release move forward?
See Fendix in use.
Move through the dashboard, scan list, and scan detail in a live demo workspace.
Live screenshots of the demo workspace. No sign-up needed to open it.
Open the live demoFrom evidence to a decision
How Fendix turns security evidence into a release decision.
Follow one finding through its evidence, policy and coverage — and see why the release still needs attention.
Illustrative example: the same scenario as the demo
Missing authentication on a user endpoint
SEC-001payments-apiSeverity HIGH
Select a stage to trace its effect on the decision.
A release decision you can defend later.
A Security Decision Record keeps the release identity, the decision and its reasons, the required coverage and the policy applied together. Hosted workspaces store every decision with its rationale; immutable, hash-verifiable records are part of Managed CI, currently in limited availability.
Security decision record
Illustrative example — fictional data, not a customer record.- Release
- payments-api
- Version
- 2.14.0
- Commit
- 9f3c1ab
- Decided
- Policy
- .fendix.yaml v1, blocks at CRITICAL
Release decision
INCOMPLETE
Highest finding status
WARN
Decision reasons
- Finding SEC-001 is HIGH severity and receives WARN under the applied policy.
- Required SCA evidence is incomplete, so the release decision is INCOMPLETE.
Required coverage
SAST, secret-scanning, and DAST evidence completed; required SCA evidence is incomplete.
Accountable owner
Missing authentication on /api/users
@platform-security, due 2026-08-07
Every claim on this page is checkable.
If we can't show you how to verify it, it isn't here.
Verifiable releases
Current releases sign every binary, Linux package, SBOM and container image with cosign keyless signing through Sigstore, and attach SLSA build provenance to each binary.
Execution and data control
Run Fendix inside your network with one binary. The engine sends no usage telemetry; other connections depend on the analyzers and integrations you choose.
Reproducible benchmarks
Accuracy and performance numbers are published with the version, date, run count, and the command to reproduce them.
Visible coverage and policy
Every scanner records its state, and release-gate rules stay in .fendix.yaml. Missing required coverage appears as INCOMPLETE.
Public method and readable source
The check library, techniques, and known limits are public, and the engine source is reviewable under the MIT license.
Two delivery models. One decision layer.
Choose the path closest to how your team works.
For SaaS teams
For product teams that release continuously and need a clear decision before deployment.
- Keep delivery moving while surfacing risks that need action
- Verify critical fixes before shipping
For software houses
For teams delivering across client projects that need a consistent gate for each release.
- Apply consistent policy across repositories
- Give clients documented, auditable evidence
Arabic and Saudi readiness, built into the product.
English and Arabic carry the same product depth and technical controls, with intentional RTL composition and readable mixed technical content.
English and Arabic parity
The interface and HTML reports work in Arabic and English. Machine-readable output (JSON, SARIF) and PDF stay in English.
RTL for technical content
Visual flow follows the reading direction while paths, identifiers, SAST, and SCA remain legible.
Prove the decision on a release that matters.
A focused, managed evaluation against your own release workflow.
Scope
One repository and, where applicable, one staging API, with an agreed release policy and success criteria.
Expected outcome
A reviewed decision record, explicit coverage gaps, and a practical next-step recommendation.
Questions engineering leaders ask first.
Direct answers about fit, workflow, and evidence.
Is Fendix a scanner, or does it work with our existing tools?
Fendix runs its supported checks and can ingest supported third-party results. It then correlates evidence, applies release policy, and produces one decision with reasons and coverage gaps.
View supported capabilitiesWhich repositories and delivery workflows are a fit?
Fendix currently fits Python, Django, FastAPI, supported Node.js analysis, and API-focused products. It runs from the command line, GitHub Actions, and CI/CD workflows. We confirm fit against your repository before evaluation.
Read the getting-started guideWhat produces BLOCK, WARN, or INCOMPLETE?
Evidence, required coverage, and release policy produce the decision. A finding may receive WARN without blocking, while missing required coverage may make the release INCOMPLETE. Your policy defines when a supported finding produces BLOCK.
Read the release-decision docsWhat data leaves our environment?
The engine sends no usage telemetry. Self-hosted execution can keep target traffic and source inside your infrastructure; customer-hosted runners upload reports to your hosted workspace, and advisory queries or configured integrations may transmit metadata.
Review privacy and data handlingHow can we evaluate Fendix on our own release?
Choose one repository and an upcoming release. We agree the policy and success criteria, review the resulting decision record and coverage gaps, and finish with a clear next-step recommendation.
See the managed evaluationEvaluate Fendix in your release workflow.
Start with a technical walkthrough, or explore the live product independently.