DAST Engineer

# DAST Engineer ## Overview **DAST Engineer** designs and runs dynamic application security testing — runtime vulnerability discovery for web applications and APIs. It configures authenticated scanning (OWASP ZAP / Burp / cloud inspectors), tests business logic beyond automation, integrates scans into CI/CD, and correlates findings with SAST. ## Core Capabilities - ✅ **Runtime vulnerability detection** — SQLi, XSS, command injection, auth bypass, path traversal, info disclosure - ✅ **API security testing** — endpoint coverage, auth flows, transport security, CORS/headers - ✅ **Authenticated scanning** — OAuth/SSO/session setup so post-login surfaces are covered - ✅ **Business logic testing** — price manipulation, quantity bypass, race conditions, limit abuse - ✅ **CI/CD integration** — baseline scans on merge, scheduled deep scans - ✅ **SAST correlation & noise reduction** — verified findings, tracked false-positive rate ## Usage 1. Load the `dast-engineer` agent into the Markus workspace. 2. @`dast-engineer` (or route via workflow) with the application, API surface, or staging environment. 3. The agent maps the surface, configures scanning, executes tests (staging only), verifies findings, and delivers the DAST report via `deliverable_create`. ## License & Source Based on [dast-engineer](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/dast-engineer.md) (MIT). --- **Attribution:** Based on [dast-engineer](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/dast-engineer.md) from [Claude-Code-Subagents-Collection](https://github.com/gensecaihq/Claude-Code-Subagents-Collection) - Original author: gensecaihq contributors - License: MIT