Practical application security guidance, starting with DAST assessment planning, authenticated application testing, and turning findings into useful engineering work. Guides describe current DAST workflows; SAST, SCA, and IAST remain planned.
Understand what testing a running application can reveal—and why scope matters.
Read guide ↗Prepare credentials, verify your login journey, and confirm the protected pages you need to reach.
Read guide ↗Give developers enough evidence to reproduce, assess, and address a potential vulnerability.
Read guide ↗Use an OpenAPI definition to prepare an API-focused assessment and review endpoint coverage.
Read guide ↗DAST examines a running application from the outside. Crawlers and checks can identify suspicious behaviour, response weaknesses, and potential vulnerabilities in the areas they reach.
Start with the approved target and test window. Record what was tested, which engine and settings were used, and whether authentication succeeded. Missing findings do not establish that an application is secure.
Back to resources ↑Use a dedicated test account with appropriate permissions. Confirm the login steps, any SSO redirects, and a protected page that indicates successful authentication.
For supported recorded MFA journeys, be available to provide the OTP when prompted. Verify that the session reaches the intended protected area before interpreting authenticated coverage.
Back to resources ↑Include the affected URL or endpoint, scanner finding name, severity, evidence, and the assessment date. Describe the behaviour that requires investigation.
Have a developer validate the issue in context. Record the fix and reassess the affected path. Treat incomplete assessments and missing coverage as gaps to investigate.
Back to resources ↑Start with the OpenAPI definition that matches the environment being tested. Confirm the base URL, authorised endpoints, and any required authentication.
Review coverage alongside results. An endpoint listed in a definition is not proof that every path and operation was exercised. Document any gaps before sharing the assessment.
Back to resources ↑