● Live App Probing (DAST)

Test it running.

Dynamic Application Security Testing (DAST) checks the issues that only exist at runtime, the ones a static scan of your code can never see, by making real requests to your running app. ShipSafe's DAST is non-destructive: GET requests only, bounded and rate-limited, nothing that changes your data.

What it checks

Security headers

HSTS, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy.

CSP quality

Flags a missing policy, and weak ones that allow 'unsafe-inline' or 'unsafe-eval'. Honors a CSP set via a <meta> tag, not just a header.

Clickjacking

No X-Frame-Options and no CSP frame-ancestors means your page can be framed.

Cookie flags

Set-Cookie missing Secure, HttpOnly, or SameSite.

CORS

Reflecting an arbitrary Origin with credentials, the classic account-data leak.

Exposed paths

/.env, /.git/config, backups, /admin, and other things that should never be public. From your own machine, via the CLI or MCP, this always runs against a target you attest you own. From ShipSafe's hosted servers — including the Live URL scan on the web — it runs only once your account has proven it controls the target origin; otherwise the hosted scan skips it.

Info disclosure

Server stack traces and directory listings leaking internal detail.

Run it from your editor (MCP)

AGENT

shipsafe_dast
  url: "http://localhost:3000"
  confirmOwnership: true

Point it at your local dev server before you ship, or at a deployed URL you own. For deployed apps, the Live URL scan runs these checks plus a client-bundle secret scan in one pass.

← PreviousLive URL Scan Next →Git History Secrets