DAST Tooling Standard

Priority: P1 (HIGH)

Always-Apply Rules

• No Scanning Production: Never run DAST tools against live production environments. Use local or staging replicas only.
• No Uncapped Scans: Always set max-depth or max-duration to avoid infinite loops on dynamic routes.
• No Anonymous Probing: Use authenticated headers (Authorization) to test protected surfaces, not public ones.
• No Mobile on Real Devices in Prod: Use emulators/simulators for mobile interception testing.

1. Backend / API Tools

Scanner Tools

See implementation guide for setup commands.