DAST action

Last updated: Oct 26, 2026

The DAST action runs Fluid Attacks' dynamic application security testing scanner in your GitHub Actions workflows. It detects vulnerabilities in your live web application. To do this, it sends requests to the URLs that you configure.

If you want, you can attribute the runs to your Fluid Attacks group. For the setup, read Authentication.

Marketplace: fluidattacks/dast-action

Setup

1. Create the configuration file

Create a YAML configuration file in a location that you select in your repository. For example, .github/dast-config.yaml:

language: EN
strict: false
output:
  file_path: results-dast.sarif
  format: SARIF
dast:
  urls:
    - url: https://www.myapp.com
    - url: https://www.myapp.com/api

• language — language for vulnerability descriptions in the output (EN for English, ES for Spanish).
• strict — when false, the scanner reports findings but does not fail the pipeline. Set it to true to break the build when the scanner detects a vulnerability.
• output.file_path — path where the scanner writes the results. When the format is SARIF, the sarif_file action output also shows this path.
• output.format — SARIF gives the standard format that GitHub's code scanning API uses. Use CSV for a report that you can open in a spreadsheet.
• dast.urls — list of URLs that the scanner sends requests to. The target application must run and the GitHub Actions runner must have access to it.

2. Create the workflow

Add .github/workflows/dast.yml to your repository:

name: DAST
on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]
  schedule:
    - cron: "0 8 * * 1" # optional: weekly scan every Monday at 8am

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: fluidattacks/dast-action@<version>
        id: scan
        with:
          scan_config_path: .github/dast-config.yaml

• When the workflow runs, the target application must be public or the runner must have access to it.

3. Push and run

Commit the two files and push. The scan runs automatically on the subsequent push or pull request.

Action inputs

Action outputs

You can use these outputs in the subsequent workflow steps:

- name: Comment on PR
  if: steps.scan.outputs.vulnerabilities_found == 'true'
  run: echo "Vulnerabilities detected — check the Security tab."

Common scenarios

Scan a staging environment on pull requests only

on:
  pull_request:
    types: [opened, synchronize, reopened]

In your configuration file, use the URL of a staging environment that the PR workflow deploys.

Strict mode: block merges with vulnerabilities

For common scenarios and troubleshooting, read GitHub Actions.

Fail the pipeline when an endpoint is unreachable

Set dast.strict_connectivity: true to exit with a non-zero status code if the scanner cannot get to a configured URL during the scan. This helps you find configuration or environment problems. An empty result then means that the scan found no vulnerabilities.

dast:
  strict_connectivity: true
  urls:
    - url: https://www.myapp.com

Troubleshooting

No results appear in the Security tab

You cannot upload DAST findings to the GitHub Security tab. GitHub's code scanning API requires a specific file and line number for each vulnerability. Web application vulnerabilities detected at runtime do not have this information.

To examine DAST results, use the output file of the scanner. Set output.format: SARIF or CSV in your configuration file and read the file as a workflow artifact, or send it to a reporting tool that you select.

The scanner cannot reach the target URL

The GitHub Actions runner must have network access to the URLs configured in dast.urls. For private or internal URLs, you must use a self-hosted runner on the same network.

For common scenarios and troubleshooting, read GitHub Actions.

Read the Marketplace page for all the configuration options and more troubleshooting.