← AppSec on this origin

Dynamic Testing (DAST)

OWASP ZAP baseline on a weekly schedule and manual dispatch — GitHub Actions publishes a summary artifact on this origin. Summary only: not a live scanner and no fabricated counts.

Pipeline

Trigger
dast.yml — weekly + manual dispatch
Scanner
OWASP ZAP baseline (zaproxy/action-baseline)
Target
https://christiananaya.com · override via workflow_dispatch or DAST_TARGET_URL
Artifact
public/security/dast.json
Config
/api/dast-config · public/security/dast.config.json
ZAP baseline summary

Loading DAST evidence…

Illustrative example · not a finding from this site

Missing frame protections

Finding: A response is embeddable by another site, which could expose interactive pages to clickjacking. The real ZAP summary appears above.

Remediation: Set an appropriate CSP frame-ancestors directive and verify it on all relevant responses. Test expected embedding flows before release.