> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# DAST

> Scan your running websites and APIs for vulnerabilities an attacker can reach

Dynamic application security testing (DAST) scans a running website or API from the outside, the way an attacker would, and reports the vulnerabilities it can reach. DAST is part of the Code Security plan.

## Before you begin

* **Verify the domain.** CodeAnt AI scans only domains you have verified. To verify one, add the CNAME or TXT record the dashboard shows to the domain's DNS.
* **Gather optional context.** An OpenAPI or Swagger document helps DAST find every endpoint. Request headers, such as an `Authorization` header, let it reach pages behind sign-in. A linked repository lets DAST prove findings exploitable and run checks that need source code.

## Add targets

### Discover subdomains

1. Open **DAST** in the [CodeAnt AI dashboard](https://app.codeant.ai) and choose **Attack surface discovery**. If you have no targets yet, DAST opens it for you.
2. Enter your domain, such as `example.com`, and choose **Discover subdomains**.
3. If the domain is not verified yet, add either DNS record shown, then choose **Check verification**. DNS changes can take time to propagate.
4. Review the results in **Reachable (not added)**, **Added** and **Unreachable**. Select the reachable subdomains you want to scan and choose **Add selected to DAST**.

### Add a domain manually

Choose **Add domain** on the DAST page, or **Add domain manually** from discovery, and fill in the form:

| Field | What it does |
| - | - |
| **Target URL** | The website or API to scan, such as `https://app.example.com`. The form warns you if the URL is already a target. |
| **Environment** | **Production**, **Non-production** or **Not sure**. Production findings are prioritized in your results. |
| **OpenAPI / Swagger** | Your OpenAPI document's URL or an uploaded JSON file, so DAST can discover your API endpoints. |
| **Authentication & headers** | Headers sent with every scan request, for example to reach pages behind sign-in. Header values are encrypted. |
| **Primary repository** and **Additional repositories** | The code behind the application. DAST uses it to prove findings exploitable, and AI validation needs it. |

To change these later, open the target and select a row on its **Settings** tab.

## Run scans

* Choose **Start scan** on a target, or select several targets and choose **Scan selected**. To scan a target again, open it and choose **Re-scan**.
* To scan a target on a schedule, open it, go to **Settings**, turn on **Recurring scans** under **Schedule**, and choose a **Frequency**: **Daily**, **Every 3 days**, **Weekly**, **Every 15 days** or **Monthly**.
* To run DAST from a pipeline, see [DAST in Jenkins](https://docs.codeant.ai/control_center/dast/dast_jenkins.md).

> [!NOTE]
>
> A recurring scan starts with your organization's first pull request review after the interval has passed.

## What DAST tests

| Area | What DAST checks |
| - | - |
| **Injection and server-side flaws** | SQL injection, including blind SQL injection, command execution, XML external entities, server-side request forgery, file inclusion and path traversal, unsafe file upload, and HTTP header injection. |
| **Browser and session security** | Reflected and stored cross-site scripting, cross-site request forgery, open redirects, security headers, Content Security Policy and cookie flags. |
| **Exposed files and access** | Backup files, web server access controls, default credentials, and exposed directories and admin consoles. |
| **Network and TLS** | Open ports and the services behind them, TLS versions, ciphers and certificates, and service-specific vulnerability checks. Denial-of-service checks are never run. |
| **Known vulnerabilities (CVEs)** | Software and versions the target exposes, matched to CVEs only when the evidence is specific to your hostname. These are reported as potential vulnerabilities and are not exploited automatically. |
| **APIs** | Endpoints from your OpenAPI document and from your application's JavaScript, GraphQL endpoints, schemas and operations, and backend APIs on other domains when the evidence shows they belong to the same application. Publicly exposed API documentation is reviewed to separate intentional public docs from real exposures. |
| **Data exposure** | API keys and email addresses in your JavaScript bundles, and publicly listable cloud storage. |
| **Unauthenticated abuse** | With a linked repository, endpoints that change data or incur cost without sign-in and lack effective limits. Each one is confirmed without credentials before it is reported. |

With a linked repository, **AI validation** tries each candidate finding against the running target and marks the ones it proves as **Confirmed exploit**.

## Review results

Open a target to see its latest scan.

* **Issues** lists active findings, most severe first. **Suppressed Issues** holds findings whose AI validation result was not confirmed, inconclusive or an error. Suppressed findings are not counted in your issue totals.
* Open a finding to read **Why is this an issue?**, **Where is the issue?**, **How to fix it?** and the **Evidence** the scan captured.
* From a finding's menu, choose **Copy AI prompt** to paste it into your AI coding assistant, or **Dismiss finding** to accept its risk. Dismissed findings move to the **Dismissed** tab, where you can restore them.
* **Network**, **Request logs**, **Routes** and **Checks** show the open services, the requests the scanner made, the routes it found and every check that ran.
* To share the results, choose **Export as XLSX** or **Export as Report (PDF)**.

## Troubleshooting

> **Domain verification fails**
>
> Confirm the CNAME or TXT record matches the name and value shown in the dashboard exactly. DNS changes can take time to propagate; wait and choose **Check verification** again.

> **A scan shows Completed with errors**
>
> Part of the scan could not run. If the target does not respond over HTTPS but does over HTTP, DAST runs only its passive header and cookie checks over HTTP. Make sure the target URL is reachable from the internet over HTTPS, then choose **Re-scan**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.