What is the difference between DAST and SAST?

SAST reads source code to find risky patterns before the app runs. DAST attacks the running app without the code. Strix does both at once when you connect a repository: agents read the code while exploiting the live target, so coverage goes deeper than either technique alone.

Does Strix DAST support authenticated scanning?

Yes. Provide test accounts and Strix agents log in, hold real sessions across roles, and test the functionality behind the login, including authorization boundaries between users and tenants.

Can Strix test APIs, not only web pages?

Yes. Strix agents test REST and GraphQL APIs directly, including object-level authorization, injection, rate limiting, and mutation abuse, and validate each finding with a reproducible exploit.

Can I run Strix DAST on my own infrastructure?

Yes. The open-source engine is free to run yourself, self-hosted or fully air-gapped, with your own LLM keys or a local model. The hosted platform adds one-time pentests and continuous testing on every pull request and deploy, self-serve with no sales call.

DAST That Exploits and Fixes, Not Just Scans

Trusted by security teams at

What is DAST?

Dynamic application security testing attacks a running application from the outside, the way an attacker would, without needing the source code. Classic DAST replays a fixed payload list and flags suspicious responses. Strix runs the same black-box test with AI agents that reason from each response, chain weaknesses into a working exploit, and prove impact before anything reaches your backlog.

Why classic DAST stalls

The scanner runs fine. The output is the problem.

Pattern matches, not proof

A response that looks like an error becomes a finding. Someone still has to reproduce it by hand before it is real.

Blind to business logic

Payload lists cannot see broken authorization, race conditions, or multi-step flows. Those are the bugs that get exploited.

Triage eats the savings

Hundreds of unranked issues per scan means engineers spend the time the scanner was supposed to save.

How Strix runs DAST

Black-box testing by agents that behave like a pentester, not a crawler.

Agents that reason

Each response shapes the next request. Agents map the app, form hypotheses, and go after the weaknesses that matter.

Exploit-validated findings

Every reported issue ships with the exact request and response that proved it, so triage starts at confirmed.

Authenticated and API-aware

Test behind login with real sessions and roles. Cover REST and GraphQL APIs, not only the pages a crawler can reach.

The fix, not a PDF

Findings arrive as merge-ready pull requests when a repository is connected, and get retested after the merge.

Runs in CI/CD

Attack every deploy and pull request from GitHub Actions, or schedule continuous coverage on production.

Open source you can run yourself

The engine is open source with a hosted option when you want scans without operating anything.

DAST scanner vs Strix

Both test the running app from the outside. Only one proves what it reports.

Capability

Strix

Classic DAST scanner

Test method

AI agents that reason and chain exploits

Fixed payload list and response matching

Proof per finding

Working exploit with request and response

Pattern match

Business logic and authorization flaws

yes

no

Authenticated testing

yes

Partial: often fragile login scripts

REST and GraphQL APIs

yes

Partial

False positives

Low: validated before reporting

High: manual triage required

Fix delivered

Merge-ready pull request

Generic remediation text

CI/CD and pull-request testing

yes

Varies

Open source

yes

Rarely

How you buy

Free open-source core; self-serve, no sales call

Annual license or per-scan-hour billing

Test method

Strix

AI agents that reason and chain exploits

Classic DAST scanner

Fixed payload list and response matching

Proof per finding

Strix

Working exploit with request and response

Classic DAST scanner

Pattern match

Business logic and authorization flaws

Strix

yes

Classic DAST scanner

no

Authenticated testing

Strix

yes

Classic DAST scanner

Partial: often fragile login scripts

REST and GraphQL APIs

Strix

yes

Classic DAST scanner

Partial

False positives

Strix

Low: validated before reporting

Classic DAST scanner

High: manual triage required

Fix delivered

Strix

Merge-ready pull request

Classic DAST scanner

Generic remediation text

CI/CD and pull-request testing

Strix

yes

Classic DAST scanner

Varies

Open source

Strix

yes

Classic DAST scanner

Rarely

How you buy

Strix

Free open-source core; self-serve, no sales call

Classic DAST scanner

Annual license or per-scan-hour billing

From issue to fix in seconds

Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847

SSRF via URL Parameter in /api/proxy

OpenHigh · 8.6CWE-918

TL;DR

The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact

Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location

acme/api · proxy-handler.ts:23

GET/api/proxy?url=

Severity

High

CVSS

8.6

Fix Effort

Low

Discovered

2h ago

Discover & Validate

Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction

How do I fix it?

Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy

23	23	const targetUrl = req.query.url;
24		const resp = await fetch(targetUrl);
	24	const parsed = new URL(targetUrl);
	25	if (!ALLOWED_HOSTS.has(parsed.hostname)) {
	26	throw new ForbiddenError("blocked");
	27	}
	28	const resp = await fetch(parsed.href);
25	29	return res.json(await resp.json());

✓Fix verified — vulnerability no longer exploitable

→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix

Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Frequently asked questions

Common questions about dynamic application security testing.

Dynamic application security testing (DAST) tests a running application from the outside, sending requests the way an attacker would and analyzing the responses. It does not need source code, which makes it a black-box technique that finds issues in the deployed app, its configuration, and its APIs.