DAST in CI/CD, on every pull request
Every merge can ship new attack surface. NightVision runs whole-app DAST as a pipeline step, and findings land where developers already work.
Security that runs outside the pipeline never keeps up with what the pipeline ships.
When DAST is a scheduled, point-in-time event, results arrive after the merge, in a portal nobody checks, routed to someone who cannot fix them.
Whole-app DAST as a pipeline step
Connect the CI you already run
GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines; any CI that runs a shell command can run a scan. Coding agents can initiate the same scans over MCP.
Scan the app the way a user sees it
A real-browser crawler with LLM-based form handling, WebDriver BiDi-based intelligent waiting, and duplicate page detection. Record your login once with Playwright; credentials are vaulted, TOTP/MFA supported. The crawler in depth.
Findings developers act on
SARIF into GitHub Security Alerts and the pull request. Request-level findings retain HTTP evidence; on supported source-discovered API scans, Code Traceback annotates the file and line, context agents can use to propose changes and rescan.
API scans complete in 10 to 15 minutes, which is why they can sit inside a pull-request workflow instead of running as an overnight batch.
The login-check gate: fail loud, never fail clean
The most dangerous DAST run silently logs out and keeps crawling public pages while the report comes back green. NightVision verifies authentication before testing begins; a broken session is a red build, not a hollow clean report.
Fail the build on your policy, not ours
Severity thresholds decide whether findings fail the build, annotate the pull request, or both. Findings also route to Jira, Slack, and Microsoft Teams with the same evidence the pull request sees.
Runtime-tested findings with retained HTTP evidence where the check provides it: concrete input for a review or merge gate.
DAST in CI/CD: common questions
Which CI/CD providers does NightVision integrate with?
GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and Bitbucket Pipelines. Any CI that can execute a container or shell step can run a scan through the NightVision CLI. Results export as SARIF and route to Jira, Slack, and Microsoft Teams.
Can NightVision scan authenticated areas of the app in CI?
Yes. Record the login once as a Playwright script; NightVision vaults the credentials and replays the flow at scan time, TOTP and MFA included. A login check verifies the session before testing begins and fails the pipeline if authentication is broken.
Will scans block my pipeline?
Only if you configure them to. Severity thresholds decide whether findings fail the build or simply annotate the pull request; most teams start non-blocking, then tighten to a required check once the baseline is clean.
How do developers receive findings?
As SARIF in GitHub Security Alerts and in the pull request. Request-level findings retain HTTP evidence and may include a curl replay and AI-written explanation; supported API findings from source-discovered targets can be annotated at the file and line that defined the endpoint.
Can CI scans reach apps that only run on our private network?
Yes. NightVision's Smart Proxy makes an outbound connection from inside your network, so pipeline-triggered scans reach internal and pre-production environments without inbound firewall changes. See private network scanning.
Put DAST in the pipeline.
Book a demo and see a pull-request scan wired end to end, or start free and onboard your first application in 6-12 clicks.