DUBLIN, California — August 11, 2026 — Safeguard today announced Safeguard DAST, dynamic application security testing that runs against a live target and reports what it actually reached. Safeguard DAST maps an application's external attack surface, analyses the JavaScript the application serves to its own visitors, and states the coverage behind every result.
Dynamic testing has a reporting problem that has little to do with detection. A scan that returns twelve pages and no findings reads identically to a scan that returned twelve pages because it stopped at a page budget — and only one of those is good news. Safeguard DAST records what it fetched, what it discovered but did not reach, and why it stopped, then reports a Coverage Score alongside the findings. A fast scan that found 400 URLs and crawled 25 of them says so.
The crawl is evidence-led rather than guess-led. It follows links, resolves redirects, and runs a headless-browser stage for applications that render in JavaScript; it seeds from what the site itself declares — robots.txt, sitemaps, published OpenAPI and WSDL contracts, security.txt — and cross-validates certificate-transparency records to find subdomains before it starts. Historical URLs come from the Internet Archive, which surfaces paths a live crawl cannot reach because nothing links to them any more.
What the scan learns becomes an inventory rather than a list of alerts: domains and subdomains, crawled pages, API endpoints with their request and response detail, open ports and service versions, TLS certificates with expiry and algorithm, DNS records including SPF and DMARC posture, HTML forms, request parameters, sitemaps, and archived URLs — each a view of the same surface, answerable on its own.
Served JavaScript, analysed in full
Safeguard DAST analyses each JavaScript, JSON, and source-map file on the complete fetched body rather than a truncated snippet, which is where secrets in production bundles tend to sit. It reports exposed credentials, API endpoints, client-side routes, cloud-storage references, personal data, exposed configuration, and sensitive developer comments, and flags a published source map — a reachable one hands over the original, unminified source.
Every reported secret carries a redacted sample only. The scanner masks at detection time, and no raw credential is stored or returned. The console shows the file's source with the finding in place, syntax-highlighted, with minified bundles reformatted so a 64KB single-line file can be read as code — because a finding at "line 1, column 4021" is not something an engineer can act on.
"Detection-only dynamic testing hands you a list and leaves you to work out whether it looked anywhere useful," the Safeguard team said. "We report the coverage next to the finding. If a scan reached one of twelve hosts, that belongs on the screen, not in a log file."
Reconnaissance mode sends no probes
Safeguard DAST includes a reconnaissance profile that maps the attack surface — subdomains, addresses, ports, services, certificates, JavaScript, archived URLs — and runs no vulnerability detection at all. Not fewer checks: none. It exists for the scan you run against production, or against an asset you are assessing but do not own, where the value is that it provably never probes.
Every scan requires a verified target. The scanner refuses to run against a host whose ownership has not been confirmed, and every request is gated by scope, rate, and budget limits.
Safeguard DAST at launch
- Four scan modes — Fast (an entry-host pass in about two minutes), Deep (unlimited crawl depth with a browser stage and full discovery), Progressive (deep coverage with early results surfaced as the crawl continues), and Reconnaissance (surface mapping, no probes).
- Attack-surface inventory — domains and subdomains, pages, APIs, ports and services, certificates, DNS, forms, parameters, sitemaps, and archived URLs.
- Certificate-transparency subdomain discovery, cross-validated against independent sources to suppress stale and wildcard noise.
- JavaScript and JSON analysis on the full body — secrets, endpoints, routes, cloud storage, PII, configuration exposure, and source maps.
- Redacted secret samples only — masked at detection; no raw credential is stored.
- Source shown in place — syntax-highlighted, with minified bundles reformatted for reading.
- Coverage Score — how much of the discovered surface the scan reached, with the reason it stopped.
- Validated findings — findings the scan reproduced are separated from those it did not.
- Authorised targets only — ownership verification is required before any request is sent.
Availability
Safeguard DAST is available now in the Safeguard platform at app.safeguard.sh, configured from the Integrations page against any target you are authorised to assess.
Acknowledgements
Safeguard DAST owes much of its final shape to Divya Chaudhari and Akash Motkar, whose QA feedback and guidance through testing drove a great deal of what shipped — including several of the decisions above about what the product should report, and what it should stop reporting.
About Safeguard
Safeguard is the AI-native software supply chain security platform. Safeguard catches Zero Days, autonomously remediates them at 100-layer dependency depth, and ships 500K+ curated zero-CVE components so customers deploy clean. Learn more at safeguard.sh.
Media contact: hi@safeguard.sh
