---
metadata:
  - name: generator
    content: Diplodoc Platform v5.66.0
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/dast.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/dast.md
  - href: https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/dast.md
    type: text/markdown
    title: Markdown version
  - href: https://sourcecraft.dev/portal/docs/en/llms.txt?revision=r21973087
    rel: describedby
title: Dynamic security testing in SourceCraft
description: Configure and run dynamic application security testing in SourceCraft using the integration with Yandex Security Deck and SolidPoint DAST.
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt?revision=r21973087


# Dynamic security testing in SourceCraft

<!-- source: en/_includes/sourcecraft/dast-intro.md -->
_Dynamic Application Security Testing_ (DAST) allows detecting vulnerabilities in a running application. A scanner accesses an application at the specified URL, goes through the available pages and endpoints, sends test requests, and analyzes responses.

In SourceCraft, dynamic testing is implemented using the integration with [Yandex Security Deck](https://yandex.cloud/en/docs/security-deck/) and [SolidPoint DAST](https://solidwall.ru/solidpoint-dast.html). It uses the [application and service endpoints scanning](https://yandex.cloud/en/docs/security-deck/concepts/vulnerability-management#endpoint-vulnerability-scanning) feature of the Vulnerability Management (VM) module in Security Deck. You can use the SourceCraft UI to set up and run testing as well as view warnings.

{% note warning %}

The Vulnerability Management module feature in Security Deck is at the [Preview stage](https://yandex.cloud/en/docs/overview/concepts/launch-stages).

You need to enable the [paid SourceCraft Security option](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing.md#security). Running a test uses the organization’s [CI quota](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing.md#tariff-differences).

{% endnote %}
<!-- endsource: en/_includes/sourcecraft/dast-intro.md -->

## Running dynamic testing {#run}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories** and select a repository.
1. Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** on the repository page, go to ![image](../../_assets/sourcecraft/dast.svg) **Dynamic testing**.
1. In the top-right corner, click **Run dynamic testing**.
1. In the window that opens, in the **Target URL** field, enter the base URL of your running application.

    The URL requirements are as follows:
    * It must provide access over HTTPS on standard port `443`.
    * It must be from the Yandex Cloud public IP address range.
    * It must not include user credentials.

    {% note info %}

    If the URL does not meet the requirements, you will get an error message. Check the protocol, port, and IP addresses the application's domain name resolves to, then edit the URL.

    {% endnote %}

1. Confirm that you understand the nature of check.

    {% note warning %}

    DAST runs on an active application by creating additional workload and sending requests that may trigger actions in the application and related systems. Keep this in mind when choosing an application and testing time.

    {% endnote %}

1. Click **Run now**.

## Viewing results {#results}

Under ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** on the repository page, go to ![image](../../_assets/sourcecraft/dast.svg) **Dynamic testing**.

Use the search bar and filters to find the warnings you need. The default filter is by the **Open** and **Confirmed** statuses. If the list is empty, check or reset the filters. To change the order of warnings, use sorting by significance.

You can find examples of detected vulnerabilities in the **Dynamic testing** section of the [demo repository](https://sourcecraft.dev/examples/appsec-analysis/security/dast).

Here is an example of a list of warnings from the demo report:

![Example of dynamic testing results: the list of detected vulnerabilities, their statuses, and significance levels](../../_assets/sourcecraft/dast-results.png)

The `localhost` addresses on the screenshot are demo data. To run scanning via Security Deck, use an application address that meets the [requirements](#run).

#### Use cases {#examples}

* Testing a deployed application for vulnerabilities before releasing a new version.
* Retesting an application after fixing the detected issues.

#### Useful links {#see-also}


* [Dynamic testing in the `appsec-analysis` demo repository](https://sourcecraft.dev/examples/appsec-analysis/security/dast)
* [Security in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview.md)
* [Static application security testing in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/sast.md)
* [Scanning application and service endpoints in Security Deck](https://yandex.cloud/en/docs/security-deck/concepts/vulnerability-management#endpoint-vulnerability-scanning)
* [SourceCraft pricing policy](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing.md)