DAST — Guardrails & Access
DAST is intrusive by design — it sends real payloads — so its guardrails are the strictest of any module. They keep active testing scoped to the customer's own, already-discovered surface and prevent it from hammering or wandering off an app.
Access: what DAST needs from the customer
Nothing. Like EASM, DAST is fully external and agentless — no credentials, no
agents. It tests over the public internet from the platform's NAT Elastic IP
13.50.172.131 (allow-list this), with a branded S.E.T-Scanner/... user-agent.
Guardrail 1 — surface-gated (only what EASM discovered)
DAST tests only the web apps EASM promoted into the DAST surface — never an
arbitrary URL someone types. It consumes InputKind.DAST_TARGETS; with an empty
surface the API refuses the scan:
409— "DAST requires a completed EASM scan that discovered web apps. Run EASM first."
This keeps active testing locked to surface the organization is already known to own.
Guardrail 2 — bounded crawl (never hammer or wander)
The active crawler (katana) is hard-bounded in code
(app/scanners/dast/katana.py):
| Bound | Value | Effect |
|---|---|---|
| Depth | 3 | How far it follows links from each seed. |
| Concurrency | 10 | Parallel in-flight requests. |
| Rate limit | 100 req/s | Caps request pressure on the target. |
| Max URLs | 5000 | Hard ceiling per crawl. |
| Field-scope | rdn (root domain) | Stays within each seed's own root domain — never follows off-site links. |
| Per-request timeout | 10s | No hanging on a slow endpoint. |
Guardrail 3 — on-demand only
DAST never starts on its own. EASM feeds it the surface, but a human must
explicitly trigger the scan (POST /org/scans {"module":"dast"}). It has its own
14-day cooldown, independent of EASM, and runs to completion under the same
per-tool inactivity watchdog as every module.
What DAST cannot do
- Cannot test anything outside the EASM-discovered surface (Guardrail 1).
- Cannot crawl off the seed's root domain, or exceed the depth/rate/URL bounds (Guardrail 2).
- Cannot be auto-triggered — only an authenticated, explicit request starts it (Guardrail 3).
- Cannot read customer data or touch the customer's environment — it's external.
Who operates it
On-demand, by the customer (or their UI) after an EASM scan. See Getting started for the customer flow and the UI Implementation Guide for the controls and the surface gate.