Integrating CI-driven scans - Port Swigger
Summary: PortSwigger's Burp Scanner can now run as a CI-driven scan, spinning up an instance of the scanner inside a Docker container that performs a local scan on a URL set by an environment variable in the pipeline script. When the scan finishes, that instance sends results to the Burp Suite DAST server in JUnit XML format, with setup walkthroughs provided for Jenkins, TeamCity, and GitHub Actions and generic instructions for platforms including CircleCI, Bamboo, and Azure DevOps.
What's compelling: Scans configured through a YAML file can run before an application reaches production, so the pipeline itself becomes the point where a vulnerability is either caught or shipped.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026