How we’re using DAST 2 for easier scan configuration and reduced noise

This post details the migration of GitLab's DAST CI job configuration from DAST 1 to DAST 2. Key technical contributions include: 1. Transitioning from `DAST_EXCLUDE_RULES` to `DAST_ONLY_INCLUDE_RULES` for more efficient and stable scan rule selection. 2. Enabling DAST auto-update by pinning the analyzer to version 2, leveraging the new configuration options. 3. Removing deprecated DAST configuration variables like `DAST_AUTH_EXCLUDE_URLS`. The post also highlights the benefits of vulnerability aggregation in DAST 2 for reducing noise in the vulnerability dashboard and discusses the identification of new features and bugs through dogfooding.