One DAST platform for the whole application.
Map APIs from source, crawl in a real browser, test fully authenticated, and return evidence developers and agents can use.
One pipeline workflow: map, test, evidence, verify.
Source intelligence feeds the scan; a verified fix workflow follows it. Fundamentals: our application and API security testing guide.
Connect
Repo + pipeline: GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket. No agents.
Map
The crawler explores the running app while API eNVy™ generates an OpenAPI spec from source in under 20 seconds.
Test fully authenticated
Recorded Playwright login, MFA included. A login-check gate fails the pipeline if authentication breaks.
Fix and verify
SARIF lands in GitHub Security Alerts, and coding agents can propose a fix and rescan before review.
Start where you are. Add source and agents when you are ready.
The same engine runs underneath all four. Teams usually start at the first rung, because it covers the applications nobody onboarded, then climb as access and appetite allow.
Black box
Point it at a running app. A URL or an uploaded spec is enough, fully authenticated with MFA, no source access and nothing for the app's builder to install.
Gray box
Add the source. Repo-derived routes feed the same scan, and source-discovered API findings carry Code Traceback to file and line.
CI/CD
Gate every build. GitHub, GitLab, Jenkins, Azure DevOps, and Bitbucket, with results landing as SARIF in GitHub Security Alerts.
Agent-native
Your agents drive it. Any MCP-capable coding agent launches the scan, reads the evidence, proposes the fix, and rescans before a human merges.
The first rung is how security teams cover applications built outside engineering. The fourth is where coding agents plug in.
A DAST platform built around a crawler for modern apps
Modern apps are JavaScript-rendered, validation-gated, and stateful, so legacy crawlers die at the first form. Three mechanisms fix that:
Forms that actually submit
Each rendered form is filled with valid, internally consistent values, so validation-gated submits fire the underlying API. How intelligent form handling works →
No blind timeouts
The crawler advances only when network and DOM activity quiesce: standards-based waiting, no hardcoded sleeps. Why intelligent waits matter →
Every state once
DOM, URL, and action signatures collapse templated screens into one logical state, so crawl budget goes to new surface. The research behind it →
Go deeper: web app DAST built for modern apps. Evaluating vendors? See NightVision vs HCL AppScan and NightVision vs Checkmarx.
Evidence developers and agents can act on
Code Traceback
On supported API scans backed by source discovery, request-level findings can link to the file and line that defined the endpoint. How source-linked DAST works →
Where developers look
SARIF lands findings in GitHub Security Alerts and the pull request, not another dashboard.
Understand & reproduce
Explain with AI adds context; Validate with Curl replays the relevant HTTP request.
Agent fix, verification scan
A coding agent proposes a change and runs another scan before the code enters human review.
Repository permissions and branch protections still govern what ships. Go deeper: AI-assisted vulnerability remediation.
Ready for enterprise review
SOC 2 Type 2 attestation (report available under NDA), plus the controls your security and IT teams already run.
Read what our SOC 2 exam means for you, or see all integrations.
"We demonstrated developer teams executing a DAST scan on a web app … during build time, with tickets for findings opened automatically with Engineering."Steve McKinnon · Senior Application Security Engineer, BeyondTrust
Platform questions, answered.
What is DAST?
Dynamic Application Security Testing tests a running application from the outside, sending real requests and analyzing responses to find vulnerabilities like SQL injection, XSS, and authentication flaws. NightVision retains HTTP evidence on request-level findings so teams investigate observed behavior, not predictions.
How does NightVision run fully authenticated scans with MFA?
Record the login once as a Playwright script; credentials are automatically extracted and vaulted. Scans complete TOTP-based MFA at scan time, and a login-check gate fails the pipeline instead of silently scanning logged out. See authenticated scanning.
How does NightVision run DAST in CI/CD?
Native integrations with GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and Bitbucket. Findings surface in the PR and in GitHub Security Alerts via SARIF; supported source-discovered API scans can add endpoint file and line context.
Can coding agents use NightVision?
Yes. The open-source MCP server exposes targets, scans, checks, and API discovery to coding agents, and Agent Skills guide the workflow. Agents can propose fixes and rescan; repository controls govern review and merge. See NightVision for coding agents.
See your app the way an attacker maps it.
Map attack surface from the browser and source, and return runtime evidence to the people and agents who own the fix.