DAST Workflow
When to use
DAST tests a running application from the outside. Where sast-orchestrator reads code, DAST sends HTTP requests and looks at response patterns. That covers runtime behaviour SAST doesn't see (auth flows, session handling, header config, reverse-proxy misconfig, DoS sensitivity).
Activates on:
- A request like "set up ZAP against our staging", "run a baseline scan", "review this Burp output", "how does the scanner log in", "DAST in CI".
- A new deployable envi
[Description truncada. Veja o README completo no GitHub.]