To run DAST in CI without slowing builds, run a short passive baseline scan on each merge, run the deeper active scan on a nightly or pre-release schedule, and decide in advance which results fail the pipeline. Fast checks gate merges. Slow checks report on a timer.
Two tiers
| Tier | When | Scan | Time budget | Blocks merge |
|---|---|---|---|---|
| Fast | Every merge | Passive baseline | A few minutes | On chosen rules |
| Deep | Nightly or release | Authenticated active scan | Set a wall clock cap | Opens tickets, blocks release |
ZAP's baseline script is built for this. Its documentation says it runs a spider for one minute by default, waits for passive scanning, performs no attacks and runs for a few minutes at most. The full scan has no spider time limit by default, so cap it yourself.
Exit codes
The ZAP scan scripts return 0 for success, 1 if any rule is set to fail, 2 if there are warnings and no failures, and 3 for other failures. By default every alert is a warning, so a fresh setup returns 2 and many pipelines treat that as pass. Choose on purpose.
Steps
- Deploy the build to an ephemeral or shared staging environment before the scan job.
- Run the baseline against it with a report output.
- Generate a config file, then set noisy rules to ignore and the rules you care about to fail.
- Store the report as a build artifact so reviewers can open it.
- Schedule the active scan with a time cap and an authenticated test account.
- Route results to your tracker with a severity filter so developers see a short list.
- Review the config monthly, because rules change and apps change.
Avoiding flaky runs
Wait for the deploy to be healthy before scanning. Use stable test data. Give the scan its own account so rate limits and lockouts do not hit other tests. Never point CI scans at production by default.
What to gate on
Start with a small blocking set: missing transport security, exposed secrets in responses, and clear injection findings. Expand as the noise drops. A gate nobody trusts gets disabled.
Try it yourself
Open the gate demo and see how a failing check blocks a change before merge.
Click through it at your own pace, or open it full screen.
Quick check
Should DAST block every pull request?
Usually only a fast passive check. Deep active scans run on a schedule so developers are not waiting.
What does exit code 2 mean?
ZAP's scripts use it for warnings with no failures. Treat it as pass or fail by your own policy.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
