qa-dast

Adversarial unifier of multi-scanner DAST output (ZAP + Burp Pro/Enterprise + NightVision). Reads each scanner's normalized JSON; deduplicates by `(URL, finding-class, parameter)` recording all scanners that flagged each finding; applies `.dast-waivers.yaml` waivers (rejects without `expires:` + `approved_by:` + `reason:`); classifies into Critical / High / Medium / Low / Info; emits PR-comment summary with verdict (BLOCK / PASS). Refuses to mark PR pass if any unwaived critical finding remains. Same pattern as sast-finding-triager + iac-policy-checker. Use after any subset of the DAST scanners runs in CI.

Configures and runs OWASP ZAP baseline scanning - `zap-baseline.py` Docker-packaged spider + passive scan suitable for CI gating; supports `-t target_url` + `-r html_report` + `-c config_file` rule customization (INFO/IGNORE/FAIL warnings); pairs with `zap-full-scan.py` for active scanning; supports authenticated scans via `-n context_file` and Ajax spider via `-j` for JS-heavy SPAs. Use when the user runs OWASP ZAP for pre-prod web app DAST.

Configures authenticated DAST sessions in ZAP - ZAP Context + Authentication Method (form, JSON, script, browser-based, HTTP/NTLM), Session Management strategy (cookie, header, script), Verification Strategy (regex indicators, poll-URL), CSRF token handling, OAuth/bearer header injection, logged-in/logged-out indicator calibration, and context XML export for use with `-n` in baseline and full scans. Use when the team needs DAST coverage of authenticated routes - the most common DAST gap and the hardest DAST setup to get right.

Build-an-X for a layered DAST baseline workflow - ZAP baseline (passive, PR-blocking) → ZAP full-scan (active, nightly on staging) → optional Burp Pro deep scan (per-release, paid-tool deep coverage); manages baseline-finding ratchet, alert deduplication across runs, and CI cadence (PR-blocking baseline + nightly deep scan + per-release deep). Use when the team adopts DAST and needs an end-to-end coverage strategy beyond running a single tool.

Configures and runs NightVision - "white-box-assisted Dynamic Application Security Testing (DAST) tool" that "analyzes code before simulating attacks and traces findings back to their origin"; supports OpenAPI / Postman / GraphQL / web app + REST API targets; auth via Interactive Logins / Header & Cookie / TOTP; per-finding suppression via Alert Rules; CLI integration via `nightvision` command. Use when the team needs DAST that traces findings back to source code (white-box-assisted) on top of OWASP ZAP's pure black-box approach.

Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t <path>` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j` for the dast-finding-triager, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds. Use when the team runs Nuclei alongside ZAP for template-driven DAST coverage, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.