DAST for Platform Engineers who own the pipeline
A scanner is another pipeline dependency, and you get paged when it flakes. NightVision runs as a CI step, fails loud, and reaches private networks.
A scan step that behaves like the rest of your CI
Native in the five major CI systems
Run as a pipeline step in GitHub Actions, GitLab CI/CD, Jenkins, Azure DevOps, and Bitbucket Pipelines. The CLI authenticates with a service token and returns machine-readable results, so one pattern ports across every repo.
The login-check gate fails loud
NightVision replays the recorded Playwright login and verifies the session before testing begins. If authentication fails, the pipeline step fails with a verdict, not a scan that quietly means nothing.
Results land where developers look
SARIF flows into GitHub Security Alerts, right in the PR view; supported source-discovered API findings carry file and line. No custom parser, no separate portal. See how findings become fixes.
Ineo wired NightVision into an Azure DevOps CI/CD branch in their first onboarding session and was scanning both their public-facing APIs and a localhost dev environment from the pipeline.
Reach every environment without owning new infrastructure
Private networks via Smart Proxy
Smart Proxy scans apps inside private networks with no agents, no inbound firewall rules, and no network changes.
Terraform modules for in-VPC scanning
When policy requires the engine inside your boundary, Terraform modules stand up in-VPC scanning on AWS as code you review, version, and destroy.
Full REST API and service tokens
Targets, credentials, scans, and findings are all addressable through a REST API with token auth; the CLI wraps the same endpoints.
Secrets stay out of your YAML
Playwright-recorded login credentials are vaulted automatically. Your pipeline holds one service token, not a growing pile of app passwords in CI variables.
DAST for platform engineers: common questions
Which CI/CD systems does NightVision integrate with?
GitHub Actions, GitLab CI/CD, Jenkins, Azure DevOps, and Bitbucket Pipelines, via the CLI or a pipeline step with service-token auth. Integration guides live in the docs.
What happens when the scan's login breaks?
The login-check gate verifies the session before testing begins and fails the pipeline step with a clear verdict. A green check always means the app was tested fully authenticated.
How do we scan apps on private networks?
Smart Proxy reaches private networks without agents, inbound rules, or infrastructure changes. For engine-inside-the-boundary requirements, use the Terraform in-VPC modules.
Where do results go?
SARIF into GitHub Security Alerts and the PR view, CSV export, Jira, Slack, and Teams, or raw JSON from the REST API for your own routing.
Can developers run scans without going through us?
Yes. Developers can scan from the terminal or VS Code using shared configuration. You keep the pipeline gate; they get self-service.
Where do other roles fit?
See NightVision for developers, security engineers, and security champions, or start with web app DAST.
Put DAST in the pipeline, not on your pager.
See the platform live with one of our technical experts, including the login-check gate and the SARIF flow into a real pull request.