A dynamic scanner that guesses at your app from the outside misses routes and wastes time. Safeguard's DAST page describes one that starts from what static analysis already knows.
What it is
The page says the scanner uses Safeguard's static call graph, route table and auth middleware as inputs to its crawl, and probes only the routes the static analysis found. Payloads are generated per vulnerability class: SQL, OS command, SSRF, XSS and deserialization. Endpoint inventory comes from OpenAPI specs, GraphQL introspection, gRPC reflection and live traffic samples. Coverage is the OWASP Top 10 and the API Top 10. Later scans can focus on changes since the last clean run.
Authentication
The page lists form auth, OAuth 2.0 with refresh, JWT bearer, session cookies, SAML and mutual TLS, and says sessions are re-established mid scan when they expire.
CI and networks
CI integration is listed for GitHub Actions, GitLab CI, Buildkite, CircleCI and Jenkins, with per PR delta scans and a self hosted scanner pod for internal networks.
How to use it
- Scan a staging copy, never a production system you do not own the rights to test.
- Give it a test account with the least privilege that reaches the routes you care about.
- Run a full scan once, then delta scans per pull request.
- Triage by route and vulnerability class.
What to verify
The page makes speed and false positive claims with no figures. Time a scan on your own service.
Quick check
What does a delta scan focus on?
Changes since the last clean run.
