bash 5 lines · 1 tab

Web application DAST automation with OWASP ZAP baseline scans

Kai Nakamura Apr 2026

1 tab

#!/usr/bin/env bash
docker run --rm -t owasp/zap2docker-stable zap-baseline.py \
  -t https://preview.example.com \
  -r zap-report.html \
  -I

1 file · bash Explain with highlit

DAST is useful when it is fast enough to run regularly and scoped enough to avoid chaos. I use baseline scans on pull request environments to catch missing headers, obvious injection risk, and regressions in exposed attack surface. It is not a substitute for review, but it is a useful net.

Related snips

yaml

name: semgrep

on: [pull_request]

jobs:
  scan:

Static application security testing with Semgrep in CI

semgrep sast ci

by Kai Nakamura 1 tab

javascript

const withBundleAnalyzer = require('@next/bundle-analyzer')({
  enabled: process.env.ANALYZE === 'true',
  openAnalyzer: true,
});

/** @type {import('next').NextConfig} */

Next.js bundle analyzer for targeted performance work

nextjs performance tooling

by codesnips 4 tabs

ruby

class ExplainAnalyzer
  def initialize(relation, watched_tables:)
    @relation = relation
    @watched_tables = Array(watched_tables).map(&:to_s)
  end

Fast Fail for Missing Indexes (EXPLAIN sanity check)

rails postgres performance

by codesnips 3 tabs

typescript

import express from 'express';
import cookieParser from 'cookie-parser';
import { issueCsrfToken, csrfProtection } from './csrf';
import { transfersRouter } from './routes/transfers';

const app = express();

CSRF protection with double-submit cookie

security express csrf

by codesnips 3 tabs

yaml

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

Trivy image scanning in pull request pipelines

trivy containers ci

by Kai Nakamura 1 tab

typescript

import { defineConfig, devices } from '@playwright/test';
import path from 'node:path';

export const authFile = path.join(__dirname, '.auth/user.json');

export default defineConfig({

Playwright smoke test for auth flow

testing playwright e2e

by codesnips 4 tabs

Share this code

Here's the card — post it anywhere.

Web application DAST automation with OWASP ZAP baseline scans — share card

Link copied