Creating a configuration file for a CI-driven scan with no dashboard - Port Swigger

Summary: PortSwigger documents a YAML configuration file for running Burp Suite DAST scans from CI pipelines without a dashboard, requiring a DAST server URL and API key plus start URLs for web apps or an API definition file or URL for API scans. The file also sets scope prefixes, login credentials and recorded login sequences, API authentication (API key in header, query parameter, or cookie; Basic or Bearer HTTP auth), built-in scan configurations, JUnit XML or Burp XML report formats, ignored issues, and a severity/confidence threshold that fails the pipeline step with a non-zero exit code.
What's compelling: The threshold defaults to enabled with minimum severity LOW and confidence TENTATIVE, so a CI-driven scan will fail the build on the weakest findings unless someone deliberately changes those values.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026