Skip to content
Fendix logo
08PRIVACY

Privacy Policy

The Fendix scanner collects zero telemetry. The hosted website only collects information you choose to submit, such as a walkthrough request.

What the Fendix scanner collects

  • Fendix is a self-hosted tool. It does not send any data to external servers.
  • When scanning, Fendix sends HTTP requests only to the target URL you provide.
  • White-box analysis reads source files from the local file system — no code is uploaded anywhere.
  • No analytics, telemetry, or usage tracking is included in the open-source distribution.

Walkthrough requests

  • When you request a technical walkthrough, we store the contact and company details you submit, your selected challenge, and any optional message.
  • We also store the page locale, campaign parameters, IP address, browser user agent, and request identifier for attribution, rate limiting, and spam prevention.
  • We use this information to respond to and manage your request. We do not add you to a newsletter or sell your information.
  • Operational providers, such as hosting and email delivery services, may process this information only to provide those services to Fendix.

Credential handling

  • Auth tokens passed via --auth are used only during the scan and are never persisted to disk.
  • All credentials are masked as [REDACTED] in scan reports (JSON, HTML, and SARIF output).
  • The web dashboard stores tokens in browser localStorage — they are never sent to third-party services.

Scan reports

  • Reports are generated locally and saved to the path you specify with --output.
  • HTML reports are self-contained single files with no external dependencies or tracking scripts.
  • No report data is transmitted to Fendix maintainers or any remote service.

Active probes

  • Active probes (e.g. injection, reflected XSS, open redirect, in-band SSRF, host-header injection, GraphQL introspection, HTTP method tampering) are always OFF by default.
  • Probes are rate-limited to a maximum of 20 per endpoint to prevent excessive traffic.
  • A legal disclaimer is shown in the terminal whenever --enable-active is used.
  • You are responsible for obtaining authorization before running active probes against any target.

Third-party dependencies

  • The dependency CVE checker queries public advisory databases (PyPI, npm) to identify known vulnerabilities.
  • Semgrep runs locally — no source code is sent to Semgrep servers when using Fendix.
  • All third-party tools are invoked locally; no data leaves your machine.

For responsible disclosure of security vulnerabilities, see our Security Policy.

Security Policy

Last updated: July 2026. This policy covers the open-source Fendix distribution and the Fendix website.