api-security
1 post · all writing
Authenticated DAST finds the real bugs, and that is why it is hard to automate
An unauthenticated scan reaches the login page. Everything worth finding is behind it, which is why serious DAST means credentials, session handling and a spec, and why so many pipelines quietly run the shallow version instead. What each mode is actually good for, including where Draugr currently stops.