Scan the disposable authenticated API with ZAP #31

New issue

Open

opened 2026-11-01 20:11:48 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:48 +00:00

Owner

DAST must reach authenticated API operations without modifying production or shared development data. A scanner that cannot authenticate has not established a clean result.

Scope

Configure ZAP API Scan from the generated OpenAPI against a disposable application with synthetic identities and data. Preserve independent authorization and workflow tests.

Acceptance criteria

Each run imports the actual generated schema and scans its intended operations against an isolated target. Active DAST never targets production or shared development.
Authentication setup reaches protected operations and their successful paths. Expired test credentials, denied authentication, unreachable targets, or incomplete imports fail the required check.
Every ZAP-reported vulnerability blocks, including Low severity. Informational security alerts require review, remediation, or an exact documented exception.
Ordinary progress logs remain nonblocking. The policy does not downgrade an alert to obtain success.
Exceptions include a reviewed reason, owner, and exact scope. Temporary acceptance of an actual vulnerability expires within thirty days.
The report identifies scanned operations, target identity, authentication coverage, finding status, and execution failures. Sensitive values are redacted.
Disposable data and resources are cleaned after success, failure, or cancellation. Evidence remains available through the CI report policy.
The scan remains a required check alongside explicit authorization and business-workflow tests. Schema import alone does not replace those tests.

Validation

Demonstrate a successful authenticated scan and failure for invalid authentication. Use policy fixtures for Low and informational security alerts, an expired exception, and an incomplete scan. Verify the target identifier cannot select the shared deployment.

Dependencies

#10: Generate and verify OpenAPI and the TypeScript client. ZAP consumes the generated API contract.
#13: Enforce complete validation in the shared Forgejo runner flow. The scan must run as a required CI job.
#14: Authenticate Telegram users through protected Quorum sessions. Authenticated scans need the real access gate and controlled test identities.
#26: Package and serve the website and API from one image. The scan exercises the built application in a disposable environment.

DAST must reach authenticated API operations without modifying production or shared development data. A scanner that cannot authenticate has not established a clean result. ## Scope Configure ZAP API Scan from the generated OpenAPI against a disposable application with synthetic identities and data. Preserve independent authorization and workflow tests. ## Acceptance criteria - Each run imports the actual generated schema and scans its intended operations against an isolated target. Active DAST never targets production or shared development. - Authentication setup reaches protected operations and their successful paths. Expired test credentials, denied authentication, unreachable targets, or incomplete imports fail the required check. - Every ZAP-reported vulnerability blocks, including Low severity. Informational security alerts require review, remediation, or an exact documented exception. - Ordinary progress logs remain nonblocking. The policy does not downgrade an alert to obtain success. - Exceptions include a reviewed reason, owner, and exact scope. Temporary acceptance of an actual vulnerability expires within thirty days. - The report identifies scanned operations, target identity, authentication coverage, finding status, and execution failures. Sensitive values are redacted. - Disposable data and resources are cleaned after success, failure, or cancellation. Evidence remains available through the CI report policy. - The scan remains a required check alongside explicit authorization and business-workflow tests. Schema import alone does not replace those tests. ## Validation Demonstrate a successful authenticated scan and failure for invalid authentication. Use policy fixtures for Low and informational security alerts, an expired exception, and an incomplete scan. Verify the target identifier cannot select the shared deployment. ## Dependencies - [#10: Generate and verify OpenAPI and the TypeScript client](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/10). ZAP consumes the generated API contract. - [#13: Enforce complete validation in the shared Forgejo runner flow](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/13). The scan must run as a required CI job. - [#14: Authenticate Telegram users through protected Quorum sessions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/14). Authenticated scans need the real access gate and controlled test identities. - [#26: Package and serve the website and API from one image](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/26). The scan exercises the built application in a disposable environment. ## Related work - [#27: Complete registration through verified rating-profile control](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/27) - [#48: Give operator-appointed moderators a private report queue](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/48) - [#69: Restrict participation and organizing capabilities with reversible expiry](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/69)

viacheslavshuka referenced this issue

2026-11-01 20:11:51 +00:00

Deploy validated main images to development #34

viacheslavshuka added the

labels

2026-11-01 20:13:39 +00:00

viacheslavshuka referenced this issue

2026-11-01 20:15:38 +00:00