Integration types for CI/CD platforms - Port Swigger

Summary: PortSwigger's documentation states that Burp Suite DAST offers two CI/CD integration options: site-driven scans, which let the CI/CD system pull site tree details, default scan configurations, false positive settings, and included/excluded URLs from the DAST server, and the legacy "Burp scan" option, which cannot fetch sites or their details from the server. Site-driven scans are the recommended approach for most use cases, while the legacy option is kept mainly so existing integrations configured by long-term customers keep working.
What you should know: Teams on the legacy "Burp scan" integration lose access to site details, scan configurations, and false positive settings held on the DAST server, so scan behavior in the pipeline can drift from what the security team configured. The recommendation to move to site-driven scans applies to most customers, but the legacy path stays available, which means existing pipelines will not flag the gap on their own.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026