integrating-dast-with-owasp-zap-in-pipeline

name	integrating-dast-with-owasp-zap-in-pipeline
description	Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.
domain	cybersecurity
subdomain	devsecops
tags	["devsecops","cicd","dast","owasp-zap","dynamic-testing","secure-sdlc"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"]
mitre_attack	["T1195","T1554","T1059.004"]

Integrating DAST with OWASP ZAP in Pipeline

When to Use

• When testing running web applications for vulnerabilities like XSS, SQLi, CSRF, and misconfigurations
• When SAST alone is insufficient and runtime behavior testing is required
• When compliance mandates dynamic security testing of web applications before production
• When testing APIs (REST/GraphQL) for authentication, authorization, and injection flaws
• When establishing continuous DAST scanning in staging environments before production deployment

Do not use for scanning source code (use SAST), for scanning dependencies (use SCA), or for infrastructure configuration scanning (use IaC scanning tools).

Prerequisites

• OWASP ZAP Docker image or installed locally (zaproxy/zap-stable or zaproxy/action-*)
• Running target application accessible from the CI/CD runner (staging URL or Docker service)
• ZAP scan rules configuration (optional, for tuning)
• OpenAPI/Swagger specification for API scanning (optional)

Workflow

Step 1: Configure ZAP Baseline Scan in GitHub Actions

# .github/workflows/dast-scan.yml
name: DAST Security Scan

on:
  deployment_status:
  workflow_dispatch:
    inputs:
      target_url:
        description: 'Target URL to scan'
        required: true

jobs:
  zap-baseline:
    name: ZAP Baseline Scan
    runs-on: ubuntu-latest
    services:
      webapp:
        image: ${{ github.repository }}:${{ github.sha }}