Support quick scan for DAST

Problem to solve

Users may want to use different types of DAST scans in their apps.

A full scan may require too much time to complete, and so users will eventually disable the job. That's bad.

We should provide different predefined "scan profiles", and users will be able to set a different default.

This will allow us to enable DAST back on our GitLab repositories, for example www-gitlab-com. Currently it has been disabled because of performance reasons.

Further details

See also https://gitlab.com/gitlab-org/gitlab-ee/issues/8576 and https://gitlab.com/gitlab-org/gitlab-ee/issues/7182.

Proposal

Create a DAST profile to perform a quick scan. This can be enabled by setting an environment variable.

Users can set variables at project/group level to define the scan type: DAST_SCAN_TYPE.

What does success look like, and how can we measure that?

Number of projects with a different default for DAST scan profile.

Edited Mar 20, 2019 by Fabio Busatto
Assignee Loading
Time tracking Loading