Free Scan

For developers

DAST tool for developers: web and API security scanning

DAST tests a running application from the outside, the way an attacker meets it. ScanTitan scans deployed websites and APIs so developers can find problems that source code analysis does not show, such as exposed endpoints, broken access control and risky configuration in a live environment. It does not read your source code, so it complements code scanners rather than replacing them.

  • Tests running apps from outside
  • Websites, SPAs and APIs
  • Business API for automation

Start with a free account: one website and one included website scan. API scanning and automation are on Business at $155 per asset place per year.

Create free accountSee what it tests

What DAST finds that code scanning does not

Static analysis (SAST) and dependency scanning read your source code. Dynamic application security testing (DAST) tests the deployed application. The two answer different questions, and a team usually needs both.

Code scanning (SAST, SCA)

Reads source code and dependencies before deployment. ScanTitan does not do this.

DAST (ScanTitan)

Tests the running website or API from outside: what is reachable, what it returns, and whether access control and configuration hold up.

That makes DAST the right check after a deploy, on staging or production, when problems come from configuration, authentication and the way components work together rather than from a single line of code.

What this DAST tool tests

Websites

Active website assessments with testing depths and controls. Extended profiles are on Business and Consultant. See the website vulnerability scanner.

Single page applications

An isolated browser explores supported JavaScript navigation and dynamic requests. See the SPA security scanner.

APIs

Import OpenAPI 3.0 or Swagger 2, resolved Postman v2.1, GraphQL query SDL or a self-contained WSDL 1.1 SOAP file, with Bearer, X API Key or HTTP Basic access. See the API vulnerability scanner.

Blind SSRF and XXE

Correlated callbacks help detect selected blind cases in eligible active website scans. See out of band testing.

ScanTitan API definition import and declared role access controls
Import a supported API definition and declare access comparisons between test identities. The form is shown blank.

Where it fits in a developer workflow

  1. Deploy to staging or production. Scan the deployed target, not the repository.
  2. Scan. Run a website scan, or import your API definition and scan the API.
  3. Read the findings and coverage. Each report states what was covered and what was skipped, so a finished scan is not mistaken for complete coverage.
  4. Fix and re-scan. A re-scan checks that the fix worked.
  5. Automate if you need to. The Business customer API and signed completion webhooks let your own pipeline start work and collect results. See the security scanning API.

There are no native GitHub, GitLab or Azure DevOps plugins. A CI step that calls the API is a custom integration you build.

What it does not do

Use ScanTitan alongside code review and code scanning, not instead of them.
  • No source code, dependency or infrastructure-as-code scanning.
  • No gRPC, no GraphQL mutations or subscriptions, and no unresolved imports or scripts.
  • API assessments are bounded: imported selection is limited to 32 method and path entries, and declared role comparisons use 2 to 4 identities and up to 16 GET resources.
  • Extended testing can generate more traffic. Use scan budgets and scan only systems you own or are authorized to test.

Plans for developers

Start with Free: one website and one included website scan. Business at $155 per asset place per year covers websites, public servers and Web APIs, with authenticated API tests, extended profiles, optional AI guided checks and the customer API. All paid plans are billed annually. See pricing.

DAST tool for developers questions

What is a DAST tool?

A dynamic application security testing tool tests a running application from the outside. ScanTitan does this for websites and APIs.

Is ScanTitan a SAST tool?

No. It does not read source code. Use it alongside a code scanner.

Which API formats can it import?

OpenAPI 3.0 and Swagger 2, resolved Postman v2.1, GraphQL query SDL and self-contained WSDL 1.1 SOAP.

How do I authenticate API scans?

With Bearer, X API Key or HTTP Basic access.

Does it integrate with CI/CD?

There are no native pipeline plugins. The Business customer API and signed completion webhooks let you build your own integration.

Does it support gRPC?

No. gRPC, GraphQL mutations and subscriptions are not supported.

Is it safe to run against production?

Extended testing can generate more traffic. Use scan budgets and scan only systems you own or are authorized to test.

Test your running app

Create a free account and run the included website scan, or choose Business to scan APIs and automate with the customer API.

Create free accountCompare plans