Creating a configuration file for a CI-driven scan - Port Swigger

Summary: PortSwigger's guide describes a YAML template for configuring CI-driven Burp Suite DAST scans, requiring a DAST server URL and API key (enterpriseServer.url and enterpriseServer.apiKey) plus start URLs for web app scans or an API definition file or URL for API scans. It covers scope prefixes, TLS certificates, login credentials and recorded logins, API key and HTTP authentication schemes, built-in and custom scan configurations, a correlation ID for dashboard visibility, JUnit XML or Burp XML report formats, ignored issues, and a severity/confidence threshold that returns a non-zero exit code to fail the pipeline step.
What you should know: The threshold defaults are enabled TRUE, minimum severity LOW, and minimum confidence TENTATIVE, so a CI-driven scan will fail the build on the weakest findings unless a team sets its own severity and confidence floor. Without a correlation ID, Burp Suite DAST shows no scan progress or results in the dashboard and the data lands only in burp_junit_report.xml.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026