DAST

Dynamic application security testing (DAST) scans a running website or API from the outside, the way an attacker would, and reports the vulnerabilities it can reach. DAST is part of the Code Security plan.

Before you begin

Verify the domain. CodeAnt AI scans only domains you have verified. To verify one, add the CNAME or TXT record the dashboard shows to the domain’s DNS.
Gather optional context. An OpenAPI or Swagger document helps DAST find every endpoint. Request headers, such as an Authorization header, let it reach pages behind sign-in. A linked repository lets DAST prove findings exploitable and run checks that need source code.

Add targets

Discover subdomains

Open DAST in the CodeAnt AI dashboard and choose Attack surface discovery. If you have no targets yet, DAST opens it for you.
Enter your domain, such as example.com, and choose Discover subdomains.
If the domain is not verified yet, add either DNS record shown, then choose Check verification. DNS changes can take time to propagate.
Review the results in Reachable (not added), Added and Unreachable. Select the reachable subdomains you want to scan and choose Add selected to DAST.

Add a domain manually

Choose Add domain on the DAST page, or Add domain manually from discovery, and fill in the form:

Field	What it does
Target URL	The website or API to scan, such as `https://app.example.com`. The form warns you if the URL is already a target.
Environment	Production, Non-production or Not sure. Production findings are prioritized in your results.
OpenAPI / Swagger	Your OpenAPI document’s URL or an uploaded JSON file, so DAST can discover your API endpoints.
Authentication & headers	Headers sent with every scan request, for example to reach pages behind sign-in. Header values are encrypted.
Primary repository and Additional repositories	The code behind the application. DAST uses it to prove findings exploitable, and AI validation needs it.

To change these later, open the target and select a row on its Settings tab.

Run scans

Choose Start scan on a target, or select several targets and choose Scan selected. To scan a target again, open it and choose Re-scan.
To scan a target on a schedule, open it, go to Settings, turn on Recurring scans under Schedule, and choose a Frequency: Daily, Every 3 days, Weekly, Every 15 days or Monthly.
To run DAST from a pipeline, see DAST in Jenkins.

A recurring scan starts with your organization’s first pull request review after the interval has passed.

What DAST tests

Area	What DAST checks
Injection and server-side flaws	SQL injection, including blind SQL injection, command execution, XML external entities, server-side request forgery, file inclusion and path traversal, unsafe file upload, and HTTP header injection.
Browser and session security	Reflected and stored cross-site scripting, cross-site request forgery, open redirects, security headers, Content Security Policy and cookie flags.
Exposed files and access	Backup files, web server access controls, default credentials, and exposed directories and admin consoles.
Network and TLS	Open ports and the services behind them, TLS versions, ciphers and certificates, and service-specific vulnerability checks. Denial-of-service checks are never run.
Known vulnerabilities (CVEs)	Software and versions the target exposes, matched to CVEs only when the evidence is specific to your hostname. These are reported as potential vulnerabilities and are not exploited automatically.
APIs	Endpoints from your OpenAPI document and from your application’s JavaScript, GraphQL endpoints, schemas and operations, and backend APIs on other domains when the evidence shows they belong to the same application. Publicly exposed API documentation is reviewed to separate intentional public docs from real exposures.
Data exposure	API keys and email addresses in your JavaScript bundles, and publicly listable cloud storage.
Unauthenticated abuse	With a linked repository, endpoints that change data or incur cost without sign-in and lack effective limits. Each one is confirmed without credentials before it is reported.

With a linked repository, AI validation tries each candidate finding against the running target and marks the ones it proves as Confirmed exploit.

Review results

Open a target to see its latest scan.

Issues lists active findings, most severe first. Suppressed Issues holds findings whose AI validation result was not confirmed, inconclusive or an error. Suppressed findings are not counted in your issue totals.
Open a finding to read Why is this an issue?, Where is the issue?, How to fix it? and the Evidence the scan captured.
From a finding’s menu, choose Copy AI prompt to paste it into your AI coding assistant, or Dismiss finding to accept its risk. Dismissed findings move to the Dismissed tab, where you can restore them.
Network, Request logs, Routes and Checks show the open services, the requests the scanner made, the routes it found and every check that ran.
To share the results, choose Export as XLSX or Export as Report (PDF).

Troubleshooting

Domain verification fails

Confirm the CNAME or TXT record matches the name and value shown in the dashboard exactly. DNS changes can take time to propagate; wait and choose Check verification again.

A scan shows Completed with errors

Part of the scan could not run. If the target does not respond over HTTPS but does over HTTP, DAST runs only its passive header and cookie checks over HTTP. Make sure the target URL is reachable from the internet over HTTPS, then choose Re-scan.

Get Started

AI Code Review

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE, CLI & CI/CD

Rule Reference

Resources

Before you begin

Add targets

Discover subdomains

Add a domain manually

Run scans

What DAST tests

Review results

Troubleshooting

​Before you begin

​Add targets

​Discover subdomains

​Add a domain manually

​Run scans

​What DAST tests

​Review results

​Troubleshooting

Before you begin

Add targets

Discover subdomains

Add a domain manually

Run scans

What DAST tests

Review results

Troubleshooting