Integrating a CI-driven scan with Azure Dev Ops - Port Swigger
Summary: PortSwigger published instructions for integrating a CI-driven Burp Scanner scan into an Azure DevOps pipeline, running the scan as a pipeline stage and failing builds with a non-zero exit code when issue thresholds in the YAML configuration are met. The setup requires a deployed Burp Suite DAST instance, an API user in the CI-driven scan initiator group with a saved API key, a YAML configuration file, and an Azure DevOps agent with Docker installed, and the instructions were tested with Azure DevOps version 2.387.3.
Key Takeaway: The scan fails the build on a non-zero exit code, so the issue thresholds in that YAML file decide whether a release ships or stops - and those thresholds are set by whoever writes the configuration, not by the pipeline itself.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026