Secure Code Review and Application Security
Dynamic Application Security Testing (DAST)
We set up automated security tests for your running application, including flows that require login. Tests repeat with every release, making new vulnerabilities visible early.
What it is
DAST tests the application externally by sending requests like a user. It does not require source code and detects server configuration errors. If not set up properly, it scans only the login page and cannot access session-protected areas. Therefore, authentication, session renewal and API definitions are included in the test design.
Scope
- Scans using a separate test account for each role
- API endpoints included in the test from OpenAPI or GraphQL schemas
- Excluding actions that delete data, initiate payments or send email from the test
- Scans run in the test environment and follow your release schedule
- Results compared with the previous scan, reporting only new findings
The need
When organizations need it
- When you release frequently and want to cover the period between two penetration tests.
- When your current DAST scans cannot go beyond the login page.
- When a penetration test shows that previously closed vulnerabilities have reappeared with a new release.
Method
How we work
-
Application map
We identify roles, the login flow and API definitions, and determine which actions are excluded from the test.
-
Authentication
We ensure the scan logs in with each role and renews the session when it expires.
-
First scan
We review the first scan results individually and adjust rules that generate noise.
-
Regular runs
We link the scan to your release schedule and ensure only new findings are reported.
Outcome
What you have at the end
You have a security test that covers areas behind the login and repeats with every release. New vulnerabilities introduced by a release are detected in the test environment before going live.
Frequently asked questions
Does DAST replace penetration testing?
No. DAST regularly and quickly scans for known vulnerability classes. Chained vulnerabilities and business logic flaws require expert testing.
Does scanning affect production?
We recommend running scans in a test environment. If run in production, actions that modify data are excluded and the scan rate is limited.
Are the APIs used by our mobile apps covered?
Yes. APIs used by your mobile app are added to the test via their definition file or recorded traffic.
Secure Code Review and Application Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting