Quickstart Guide

Overview

Fencer helps you secure your organization by scanning code, infrastructure, domains, and applications for vulnerabilities and misconfigurations. This guide walks you through going from a fresh account to your first scan results in under 15 minutes.

Prerequisites

• A valid email address, or a Google, GitHub, GitLab, Bitbucket, or Microsoft account to sign up with.
• At least one asset to scan — a code repository, cloud account, domain, or web application.

How it works

When you create an account, Fencer sets up an organization — your central workspace where team members, integrations, scans, and findings all live. Every piece of data in Fencer is scoped to an organization, so all members share the same view of your security posture.

After you sign up, a short setup wizard asks for your domain, lets you invite teammates, and offers an onboarding call. You then land on the Home page, where an Onboarding Checklist walks you through connecting integrations, adding assets, and configuring notifications. Steps can be completed in any order, and an Administrator can mark a step as done if it doesn’t apply to you.

Usage / Configuration

1. Create your account

1. Navigate to the Fencer signup page.
2. Enter your email address and click Start free trial, or click Sign up with GitHub or Sign up with Google. GitLab, Bitbucket, and Microsoft are under More sign-up options.
3. Complete your account: enter a password, your full name, and your organization name, accept the terms, and click Create account. The organization name also generates its URL slug (e.g., /a/my-company/).
4. Verify your email address if you signed up with email.

2. Complete the setup wizard

1. Tell us more! — enter your apex domain (e.g., example.com), select your company size (1-10, 11-50, 51-200, 201-500, or 500+), answer How did you hear about us?, and click Continue. Fencer adds the domain and starts scanning it.
2. Invite your team — choose a role, enter teammates’ email addresses, and click Invite & continue, or click Skip.
3. Schedule a call with us — book an onboarding call, then click Proceed to dashboard, or click Skip for now.

You then land on the Home page of your new organization.

3. Follow the onboarding checklist

The Onboarding Checklist on the Home page lists up to ten steps. Start with whichever is most relevant to you:

Step	Description	Est. Time
Setup Code Scanning	Connect GitHub to scan your codebase for vulnerabilities and issues	5min
Setup Infrastructure Scanning	Connect a cloud provider (AWS, GCP, Azure, Cloudflare, DigitalOcean, Heroku, Render, etc.)	5min
Review Architecture Diagram	Open your auto-generated architecture diagram	2min
Setup Domain Scanning	Add and verify a domain to analyze for security risks	5min
Setup Web Application Scanning	Add a web application to scan for vulnerabilities	5min
Setup Security Monitoring	Connect AWS or GitHub monitoring for SIEM detections (paid feature)	5min
Automate Compliance Evidence Collection	Connect Drata or Vanta for compliance reporting (paid feature)	2min
Setup Notifications	Connect Slack, or add an organization notification rule that sends email	2min
Setup Workflow Integration	Connect Linear or Jira for ticket tracking	2min
Fix a Vulnerability	Resolve your first vulnerability	5min

Note

Setup Security Monitoring and Automate Compliance Evidence Collection appear only when your plan includes them. An Administrator can mark any step as done by clicking its status circle; you can still set it up later from Admin > Integrations or the relevant page.

4. Connect your first integration

1. In the onboarding checklist, click Setup on the step you want to start with (e.g., Setup Code Scanning).
2. The Integration Settings dialog opens, listing the integrations for that capability. You can also browse every integration from Admin > Integrations.
3. Follow the on-screen instructions to authorize the integration — for GitHub, this means installing the Fencer GitHub App and selecting repositories.

5. Run your first scan

Most integrations trigger an initial scan automatically after connection. For domain and web application scanning, you add the asset directly:

1. Domain scanning — go to Posture > Domains, click Add Domain, and verify ownership by adding the DNS TXT record Fencer shows you. Fencer begins scanning DNS records, SSL certificates, DMARC/SPF/DKIM, and more.
2. Web application scanning — go to Posture > Application, click Add Application, enter your application’s details, then open it and click Run scan.

6. Review your results

1. Go to Vulnerabilities in the sidebar to see all findings across scan types.
2. Click any vulnerability to view its details — severity, affected asset, description, and remediation guidance.
3. Triage findings by changing their status (Open, Ready for verification, Resolved) or assigning them to a team member.

Note

The onboarding checklist marks the “Fix a Vulnerability” step as complete once you resolve at least one vulnerability.

7. Invite your team

1. Navigate to Admin > Team.
2. Click Invite Users.
3. Choose a role — Administrator, Team Member (the default), Read Only, or a custom role your organization has created. You can only hand out a role whose permissions you hold yourself.
4. Enter your teammates’ email addresses (you can paste several, separated by commas) and click Invite.
5. Each invitee receives an email with a link that expires after 30 days.

Examples

Typical first session for a startup:

1. Click Sign up with GitHub.
2. Name the organization “Acme Security” when you complete your account.
3. In the setup wizard, enter acme.com as your domain — Fencer starts scanning it.
4. On the Home page, click Setup on Setup Code Scanning and install the GitHub App on your main repositories.
5. Click Setup on Setup Notifications and connect Slack, then add a rule under Settings > Notifications with Send Slack channel message to #security-alerts.
6. Return to the Vulnerabilities page to review initial findings.
7. Resolve a low-severity finding to complete the “Fix a Vulnerability” step.

Troubleshooting

• Invitation link expired — Invitations expire after 30 days. Ask an Administrator to open the invitation’s menu on Admin > Team and click Resend invitation, which sends a fresh link. There is a 10-minute cooldown between resends.
• No Invite Users button — Inviting requires the members:create permission (Administrators have it) and an active subscription.
• Onboarding checklist not updating — Steps complete when the underlying work exists: an integration is connected, a domain is verified (an unverified domain leaves Setup Domain Scanning in progress), an application is added, the architecture diagram is opened, or a vulnerability is resolved. Refresh the Home page after finishing a step.
• Onboarding checklist not visible — The checklist is shown only to users who can edit organization settings and connect integrations (Administrators by default). It disappears once every step is complete or done, or after you click Dismiss (which hides it for you only).
• GitHub App not showing repositories — Ensure you granted the Fencer GitHub App access to the repositories you want to scan during installation. You can update permissions from your GitHub organization settings.

Related pages

• Platform Overview
• Onboarding Walkthrough
• Roles and Permissions
• Navigation and Layout