Introducing browser-based DAST and integrated passive checks

This post announces the full integration of passive checks into GitLab's new browser-based DAST analyzer. It details the history of DAST at GitLab, the challenges of dynamic scanning in CI/CD, and the motivation for building a new browser-instrumented engine. The new engine uses ZAP as a proxy but processes crawling and passive checks internally. The post highlights the reduction of alert fatigue and false positives through selective check implementation, aggregation of true positives, and removal of outdated checks. It also introduces the YAML-based configuration system for passive checks, providing an example for the X-Content-Type-Options header.