The DAST scanner crawls modern single-page apps behind SSO and MFA, tests every role, and validates each finding before it reaches your backlog. Run it on a schedule, or as a quality gate on every pull request.
Validated findings don’t wait in a queue. The Attack agent tries to chain each one into a real exploit path (a reflected XSS is noise, an XSS that lifts an admin session is a P1) and re-checks verified fixes daily, so a regression surfaces the next morning.
Record a login once, including SSO and MFA. The scanner keeps sessions alive and re-authenticates when they expire.
A real browser engine renders React, Vue and Angular apps and discovers the API calls behind them.
Scan as a user, a manager and an admin, then compare what each can reach to surface access-control gaps.
Each issue is re-confirmed with evidence before it’s raised, so engineers stop triaging noise.
See what’s new, fixed or unchanged since the last scan, and fail builds only on regressions.
Rate limits, excluded paths and safe-check profiles keep scans from disrupting staging or production.
Add one step to your workflow. The scanner tests the preview environment, compares results against your main branch and only fails the build on new issues that cross your policy.
name: security
on: [pull_request]
jobs:
dast:
runs-on: ubuntu-latest
steps:
- uses: vulneron/dast-action@v2
with:
target: ${{ env.PREVIEW_URL }}
profile: app-example-sso
fail-on: high
token: ${{ secrets.VULNERON_TOKEN }}We'll set up an authenticated profile with you and walk through the first results together.