draventis

Scheduled DAST (Dynamic Application Security Testing) for Kubernetes: OWASP ZAP (via the ZAP Automation Framework) + Nuclei run on a schedule against your already-deployed targets, with results reimported into DefectDojo.

Deploy it to any cluster with Helm, point it at your URLs, and it does the rest.

What it does

draventis is an orchestrator + uploader. It runs as one or more Kubernetes CronJobs; on each run it reads targets.yaml, scans each target with ZAP (and optionally Nuclei), and reimports the reports into DefectDojo.

CronJob (nightly / weekly)
  └─ draventis run --schedule <name>
       ├─ for each target: ZAP plan (by policy) → report.xml
       │                    Nuclei (optional)   → report.jsonl
       └─ reimport each report → DefectDojo /api/v2/reimport-scan/

Why DAST

Static analysis reasons about source and artifacts at rest. DAST exercises the running app: authN/session bugs, injection reachable only at runtime, response-header/TLS/cookie posture, CORS, SSRF, live API surface, and drift between the repo and what's actually deployed. See Design.

Get started

I want to…	Go to
Deploy it to a cluster with Helm	Deployment
Understand targets.yaml and chart values	Configuration
Run/develop it locally	Setup
Understand the code	Architecture
Understand why it's built this way	Design

Status

The orchestration, config model, DefectDojo uploader, ZAP/Nuclei command building, Helm chart, and container image are implemented and unit-tested. Validate the end-to-end scan path against your own environment before relying on it. Start with a single baseline target against a safe host.

License

MIT.