Dev-first API and application security testing
summary
StackHawk demonstrates an automated DAST workflow that runs a portable scanner (HawkScan) from a repo-configured stackhawk.yml, runs on every PR, and returns a non‑zero exit code to break the build when a new high severity appears. Scanner supports REST, GraphQL, SOAP, gRPC, OpenAPI and Postman inputs, runs as a container or locally, and streams results to the cloud platform with Snyk correlation and GitHub CodeQL links; demo shows one new high and 24 triaged findings.
AI-written summary · about
chapters (9)
- 0:00StackHawk introduction
- 2:20Integrating StackHawk into workflows
- 3:25HawkScan features and deployment
- 4:52Local setup and config
- 6:57Pull request integration with GitHub
- 8:00Triaging security findings
- 11:30AppSec oversight and tracking
- 12:57StackHawk’s developer-first approach
- 13:39Summary and call to action
related talks
09mAutomated Application Security Testing
09mAutomated Application Security Testing
08mAutomated Security Testing for JS Apps & Underlying APIs
09mAutomated Application Security Testing with StackHawk
09mAutomated Application Security Testing with StackHawk
09mAutomated Application Security Testing
07mSecurity Testing for GraphQL Backed Applications
09mHow to Make GraphQL Security Easier with StackHawk