What is DAST (Dynamic Application Security Testing) and where does it fit in CD?

DAST (Dynamic Application Security Testing) tests a running application by sending crafted HTTP requests and observing responses — simulating the perspective of an attacker. Unlike SAST (source code analysis), DAST requires a live application instance, making it part of the CD pipeline (after staging deployment). DAST tools like OWASP ZAP and Burp Suite Enterprise automatically probe for vulnerabilities including XSS, SQL injection, broken authentication, insecure headers, and CSRF. In a CD pipeline, DAST runs against the staging environment after deployment, before traffic is shifted to production. A vulnerability above a severity threshold blocks the promotion to production. DAST catches runtime vulnerabilities that SAST misses (e.g., authentication bypass that depends on server behavior) but is slower and can only test functionality that has been exercised during the scan.