Integrating DAST with OWASP ZAP in Pipeline

When to Use

• When testing running web applications for vulnerabilities like XSS, SQLi, CSRF, and misconfigurations
• When SAST alone is insufficient and runtime behavior testing is required
• When compliance mandates dynamic security testing of web applications before production
• When testing APIs (REST/GraphQL) for authentication, authorization, and injection flaws
• When establishing continuous DAST scanning in staging environments before production deployment

Do not use for scanning source code (use SAST), for scanning dependencies (use SCA), or for infrastructure configuration scanning (use IaC scanning tools).

Prerequisites

• OWASP ZAP Docker image or installed locally (zaproxy/zap-stable or zaproxy/action-*)
• Running target application accessible from the CI/CD runner (staging URL or Docker service)
• ZAP scan rules configuration (optional, for tuning)
• OpenAPI/Swagger specification for API scanning (optional)