DAST Workflow

When to use

DAST tests a running application from the outside. Where sast-orchestrator reads code, DAST sends HTTP requests and looks at response patterns. That covers runtime behaviour SAST doesn't see (auth flows, session handling, header config, reverse-proxy misconfig, DoS sensitivity).

Activates on:

• A request like "set up ZAP against our staging", "run a baseline scan", "review this Burp output", "how does the scanner log in", "DAST in CI".
• A new deployable environment (staging, QA, security sandbox) that needs security testing before promotion to production.
• A periodic scan against staging, or a pre-release regression run.
• A handoff from security-review where runtime behaviour needs to be verified (e.g. are the security headers actually present in the response?).
• Bug-bounty preparation: scan with DAST first to clear out the low-hanging fruit before paying hunters look at it.

When NOT to use (handoff)