DAST Workflow

When to use

DAST tests a running application from the outside. Where sast-orchestrator reads code, DAST sends HTTP requests and looks at response patterns. That covers runtime behaviour SAST doesn't see (auth flows, session handling, header config, reverse-proxy misconfig, DoS sensitivity).

Activates on:

• A request like "set up ZAP against our staging", "run a baseline scan", "review this Burp output", "how does the scanner log in", "DAST in CI".
• A new deployable envi

[Description truncada. Veja o README completo no GitHub.]