This work addresses the problem of automated vulnerability scanning for web applications within the context of DevSecOps processes and CI/CD pipelines. Introducing security testing into an automated process poses a challenge, as some vulnerabilities are difficult to scan automatically or require manual interventions, such as manual penetration testing. Our approach involves implementing an agent that automatically performs security tests and analyzes the results through graphical displays. The solution was integrated into a DevOps pipeline and tested on open-source applications. The final contribution of this thesis provides better oversight of web application security and simplifies the vulnerability scanning process for security engineers.
|
