Site and scan data settings - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite DAST attaches scan data to existing sites when a scan is triggered through the REST API's legacy "Burp scan" integration, and automatically creates a new site when no match is found. It states that these sites are hidden from the site tree by default, that matching relies on built-in rules based on site name and included and excluded URLs, and that scan results feed trend data on new, resolved, and regressed issues and on previously flagged false positives.
What you should know: Scans fired through the legacy REST integration can silently create new sites that stay hidden in the site tree by default, so a security leader may be accumulating scan data and issue history outside the view anyone is reviewing.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026