How I Got Enterprise-Grade DAST for Free in GitHub Actions

Most developers don't run Dynamic Application Security Testing (DAST) in their CI pipelines. Not because they don't want to — but because every viable option seems to cost $180k/year, take 60 minutes per scan, or require a PhD in ZAP configuration.

I spent months building ZeroDAST to prove that's a false choice.

This is the story of what I found, the real data behind it, a hands-on tutorial, and an honest comparison with enterprise DAST.

Part 1: Why Vanilla ZAP Discovers 0 API Endpoints

I started where most teams start: running OWASP ZAP against my API.

docker run -t zaproxy/zap-stable zap-api-scan.py \
  -t http://my-api:3000/api-docs -f openapi

The scanner ran. It produced a report. And the result was essentially useless for API security.

I tested vanilla ZAP against four high-profile open-source targets — NocoDB (48k ⭐), Strapi (67k ⭐), Directus (29k ⭐), and Medusa (27k ⭐). Same GitHub-hosted runners, same ZAP version (2.17.0), same Docker Compose targets. The vanilla baseline scripts are public and executable.

That's not a typo. Vanilla ZAP discovered zero API endpoints across all four targets. It found some frontend/static findings — CSP headers, cookie flags — but nothing behind authentication. The entire API surface was invisible.

The Three Auth Walls

Wall 1: Non-standard auth headers. NocoDB uses a custom header called xc-auth — not Authorization, not X-Token. If your scanner sends Authorization: Bearer <token>, NocoDB ignores it. Every request returns 401. The spider crawls the Nuxt.js SPA shell and finds frontend issues, but the API is locked.

Wall 2: Nested token responses. Even if you know the right header, you need to extract the token from the login response. Strapi returns { "data": { "token": "..." } }. Directus goes deeper: { "data": { "access_token": "..." } }. Vanilla ZAP's auth mechanisms expect the token at the root level. When it's nested under data, ZAP extracts nothing.

Wall 3: Admin vs user API separation. Strapi has two distinct auth systems — /api/auth/local for frontend users and /admin/login for admins. If you authenticate as a frontend user, the entire admin API surface is invisible. And the admin surface is usually where the interesting vulnerabilities live.

The Full Signal Impact

ZeroDAST is a strict superset of vanilla ZAP — it finds everything vanilla finds (frontend/static) plus all authenticated API findings. Switching has zero signal regression.

Auth isn't an incremental improvement. It's the entire difference between a DAST scan that finds real API vulnerabilities and one that wastes your CI minutes on frontend noise.

Part 2: What ZeroDAST Actually Is

ZeroDAST is an open-source CI DAST orchestration framework — not a scanner itself. It wraps OWASP ZAP inside a security-hardened pipeline with:

• Adapter-based authentication — 4 proven auth styles, zero custom scripting
• Two-lane privilege isolation — untrusted PR code never touches the DAST runner
• Container hardening — cap-drop ALL, no-new-privileges, read-only root, memory limits
• Delta-scoped PR scanning — only scan changed routes, not the whole API
• Intelligent reporting — diff-aware baselines, remediation guides, API inventory

The auth problem is solved through a declarative adapter model where auth configuration is config — not code:

{
  "auth": {
    "adapter": "json-token-login",
    "loginUrl": "/api/auth/login",
    "responseTokenField": "data.token",
    "headerName": "Authorization",
    "headerValuePrefix": "Bearer "
  }
}

Non-standard headers? Set "headerName": "xc-auth". Nested token? Use dot-path notation: "responseTokenField": "data.access_token". No ZAP scripting. No custom code.

Auth is validated before scanning — if it fails, you know before wasting 5 minutes:

[auth] POST /api/v1/auth/user/signin → 200 ✓
[auth] Token extracted: eyJhbGciOi... (length: 189)
[auth] Protected route GET /api/v1/auth/user/me → 200 ✓
[auth] Admin route GET /api/v1/db/meta/projects → 200 ✓
[auth] Auth bootstrap: PASS

4 Proven Auth Adapters

Part 3: Tutorial — Your First ZeroDAST Scan (5 Minutes)

Prerequisites

Docker (latest stable), Node.js 22+, Git.

Step 1: Clone and Install

git clone https://github.com/AlphaSudo/zerodast.git
cd zerodast
cd demo-app && npm install && cd ..

Step 2: Run Your First DAST Scan

chmod +x scripts/run-dast-local.sh
./scripts/run-dast-local.sh

That's it. Behind the scenes:

1. Docker --internal network isolates app, database, and ZAP from the outside world
2. Container hardening — app runs with cap-drop ALL, read-only root, memory/PID limits
3. Auth bootstrap — auto-registers user + admin, logs in, extracts tokens, injects into ZAP
4. OpenAPI import → Spider → Active Scan through authenticated requests
5. Report generation — structured findings, remediation guide, API inventory

Step 3: Read Your Results (~3 min later)

reports/
├── zap-report.json              # Raw ZAP findings
├── zap-report.html              # Human-readable report
├── environment-manifest.json    # What was scanned and how
├── result-state.json            # Triage state (clean / needs_triage)
├── remediation-guide.md         # Prioritized fix guidance
├── operational-reliability.json # Runtime health metrics
├── api-inventory.json           # Route coverage breakdown
└── api-inventory.md             # Human-readable API inventory

The remediation guide separates findings into:

• New findings → fix these first
• Persisting findings → decide: fix or accept
• Resolved findings → guard against regression

Setting Up CI: The Two-Profile Model

PR scans (~3 min): When someone opens a PR, ZeroDAST detects changed files via git diff, extracts API routes from changed controllers, and generates a scoped ZAP config targeting only those routes. Runs in a separate trusted workflow — PR code never gets secrets access.

PR opens → git diff → route extraction from changed files
    ├── routes changed → scoped ZAP config (targeted seeds only)
    └── core/middleware changed → escalate to FULL scan

Nightly scans (~5 min): Full API surface, every night. Opens a deduplicated triage issue if threshold is exceeded.

Why the split matters — it's a security architecture:

Installing in Your Own Repo

ZeroDAST adds exactly two things to your repository:

1. Two workflow files (.github/workflows/zerodast-pr.yml + zerodast-nightly.yml)
2. A zerodast/ config directory

# Install
./prototypes/model1-template/install.ps1 -TargetRepoPath 'C:\path\to\your-repo'

# Configure zerodast/config.json with your auth/endpoints/seeds
# Run locally
chmod +x zerodast/run-scan.sh
ZERODAST_MODE=pr ./zerodast/run-scan.sh

# Uninstall (clean removal)
./prototypes/model1-template/uninstall.ps1 -TargetRepoPath 'C:\path\to\your-repo'

Full install guide: MODEL1_INSTALL_GUIDE.md

Part 4: Honest Comparison — ZeroDAST vs Checkmarx DAST

If you've ever seen a Checkmarx DAST quote — $600-$1,200/dev/year, $180k-$350k annually for 50-100 devs — you've wondered if there's an open-source alternative. Here's the honest answer.

Full Capability Matrix

Where Checkmarx Wins (Honestly)

• Auth breadth: SSO/SAML/OIDC/MFA/browser recording — outside ZeroDAST's niche by design
• Detection depth: Proprietary rules may catch vulnerability classes ZAP misses — real gap
• Platform features: Full governance/compliance/RBAC/ASPM — no contest
• Shadow API discovery: Production traffic analysis — different product category
• Support: SLAs and dedicated teams vs community-only

Where ZeroDAST Wins

• Cost: $0 vs $180k+/year — for OSS and small teams, this is the difference between having DAST and not having it
• CI speed: 3-minute PR scans vs 15-60 min — ZeroDAST is architecturally faster through delta detection, not just lower budgets
• Transparency: Every script, config, and decision is inspectable shell + JS + YAML, not a proprietary black box
• Trust architecture: Genuine privilege isolation with workflow_run, --internal networking, and hardened containers
• No lock-in: Standard ZAP config, standard GitHub Actions YAML, standard JSON baselines

Who Should Use What

Use ZeroDAST if: You're an OSS maintainer or small team with a REST API, token-based auth, and no enterprise security budget. You want 3-minute PR scans and full transparency.

Use Checkmarx if: You need SSO/SAML/MFA auth, GraphQL scanning, enterprise governance, or commercial SLAs. You have the budget and the scale.

Use both if: You want fast CI-first feedback on PRs (ZeroDAST: 3 min) plus deep periodic enterprise scans (Checkmarx: proprietary rules).

What ZeroDAST Doesn't Do (Honest Limitations)

• ❌ Enterprise auth — SSO / SAML / OIDC / MFA / browser-recorded login flows
• ❌ Non-REST protocols — GraphQL, SOAP, gRPC
• ❌ Shadow API discovery — No production traffic analysis
• ❌ Platform features — No governance / compliance / RBAC control plane
• ❌ Commercial support — Community-only, no SLA
• ❌ Alpha stage — Proven on 7 targets, but still early

ZeroDAST is purpose-built for a specific niche: CI-first DAST on documented REST APIs with token-bootstrap-friendly auth. Within that niche, it delivers enterprise-grade results at zero cost. Outside that niche, use something else.

Key Numbers

Every claim is backed by a green CI run:

• NocoDB proof • Strapi proof • Directus proof • Medusa proof
• Petclinic T4 scan • FastAPI T4 scan • Nightly

Try It Now

git clone https://github.com/AlphaSudo/zerodast.git
cd zerodast
cd demo-app && npm install && cd ..
chmod +x scripts/run-dast-local.sh
./scripts/run-dast-local.sh

⭐ Star ZeroDAST on GitHub — it helps other developers find it.

🐛 Try it on your repo — if your API uses token-based auth and has an OpenAPI spec, ZeroDAST can scan it. Install guide

📊 Read the full benchmark data — 800+ lines of structured evidence.

💬 Open an issue — questions, bugs, and targets that break the adapter model are all welcome.

SEO note for self-publishing: Publish this article on your own blog/GitHub Pages first. Wait 1-3 days for Google to index it. Then repost to Dev.to using the canonical URL feature (set it in the front matter above). This way your site gets the SEO credit, not Dev.to.

All benchmark data measured on GitHub-hosted Ubuntu runners with ZAP 2.17.0. Vanilla baselines are executable at benchmarks/vanilla-baseline/. Checkmarx data sourced from official public documentation and public pricing. ZeroDAST is Apache 2.0 licensed.

Built with discipline. Proven with evidence. Licensed for freedom.