What problem does it solve? Static analysis cannot find runtime vulnerabilities like authentication bypasses, injection flaws reachable only over HTTP, or misconfigured TLS and headers on a live server. This Skill performs DAST (dynamic application security testing) against a running web app or API using OWASP ZAP in Docker, and audits dependencies for known vulnerabilities. ## Core Features & Use Cases - ZAP Automation Framework scans: Generates a single zap-plan.yaml with passive, spider, active-scan, report, and CI exit-status jobs, supporting Angular SPAs, ASP.NET MVC/Web API/Blazor/Razor Pages, Spring Boot, and Python (FastAPI/Django/Flask) targets. - Authentication-aware scanning: Configures form, token/JWT, Azure AD, and Windows/NTLM auth with a mandatory logged-in verification gate before scanning. - Dependency vulnerability audit: Runs dotnet list package --vulnerable, npm audit, pip-audit, or Maven/Gradle checks alongside or instead of the live scan. - Source-mapped fixes and ledger: Maps HTTP-layer findings back to controller/route source files, applies business-context severity overrides, and writes an HTML report plus a fingerprinted findings ledger for /fix and CI gating. - Use Case: Point it at a local staging URL of your ASP.NET MVC app, confirm the authorization gate, and receive a severity-rated HTML report with concrete file:line fixes and a diff against the previous scan. ## Quick Start Run a dynamic scan against my running app at https://localhost:5001 using a passive baseline scan plus dependency audit.
