Application security testing

This post details the evolution of GitLab's Dynamic Application Security Testing (DAST) to a new browser-based analyzer (DAST 2). It introduces passive checks that monitor network traffic during website crawling to identify weaknesses without sending disruptive requests. The aim is to reduce alert fatigue by implementing fewer checks, reducing false positives, and aggregating true positives. Passive checks are defined in YAML using a custom specification.