dast-testing

Add a ZAP baseline scan job using zaproxy/action-baseline that runs on every pull request, plus a zaproxy/action-api-scan job after staging deploys that targets your OpenAPI spec. Upload results as SARIF to the GitHub Security tab and set fail_action to block on high-severity findings.

SAST reviews source code statically, while DAST attacks the running application to find issues like SQL injection and misconfigured CORS headers that are invisible in code. Both are required because they catch different vulnerability classes.

ZAP provides broad active and passive scanning driven by an OpenAPI spec, while Nuclei uses 7,000+ YAML templates for targeted CVE, misconfiguration, and secrets detection with fewer false positives. Running both together covers roughly 70% of the OWASP Top 10.

Create a dedicated low-privilege test account in staging and pass credentials via CI secrets such as DAST_TEST_TOKEN. Configure ZAP with an Authorization header through environment variables so the scan runs in an authenticated session.

Skip DAST for internal CLI tools with no HTTP interface and pure background workers with no API surface. DAST is required for any service with external HTTP endpoints, authentication logic, input fields, or file upload handling.

DAST cannot catch business logic flaws, insecure design decisions, or authorization errors that require domain context. These gaps require manual review and threat modeling alongside automated scanning.