Dynamic Application Security Testing tests a running application by sending requests to it and observing its responses, rather than analysing source code statically. DAST finds vulnerabilities that only manifest at runtime: misconfigured security headers, injection flaws that require actual HTTP requests, authentication bypasses, and business logic errors that no static analysis tool can detect from code alone. While SAST finds the code pattern for a SQL injection, DAST confirms whether the running application is actually exploitable.
OWASP ZAP—Zed Attack Proxy—is the most widely used open-source DAST tool, providing both a passive scanning mode that observes traffic and an active scanning mode that sends attack payloads. The `zaproxy/action-full-scan` GitHub Action runs ZAP in a container against a target URL, executes the full spider and active scan, and produces a SARIF report suitable for upload to the GitHub Security tab. Running ZAP in CI against a containerised version of the application closes the gap between static analysis and real exploitability.
Analogy🏏Cricket
Think of it like cricket: Imagine the BCCI's team management system for an international tour with matches in three different countries simultaneously. Rather than a coordinator manually managing each match day's logistics, the system reads the official tour schedule document and automatically dispatches the right squad, equipment, and support staff to each venue. When the tour schedule changes—a match is rescheduled, a squad member is replaced—the system detects the change and updates the arrangements automatically. Just as the tour management system uses the official document as the source of truth and orchestrates multiple concurrent deployments to multiple venues, ArgoCD uses the Git repository as the source of truth and orchestrates multiple concurrent Application syncs to multiple clusters. Just as the system provides a dashboard showing which venues are 'ready', 'delayed', or 'degraded', ArgoCD provides a dashboard showing which Applications are Synced, OutOfSync, or Degraded. This reveals why ArgoCD is valued at scale: managing dozens of applications across multiple clusters manually is operationally equivalent to coordinating an international cricket tour by phone.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.