Using StackHawk for DAST and API Security Testing on Azure

I recently started using StackHawk, and I am impressed with the tooling.  Its DAST and API security testing are outstanding, and it integrates beautifully with VS Code.

Application security requires more than simple source code scanning. While SAST, SCA, and secrets scanning are great in CI pipelines, key vulnerabilities remain hidden until an application is running. This is where Dynamic Application Security Testing (DAST) becomes essential.

In my development environment, Claude and GitHub Copilot are building my code and do so much of the Static Application Security Testing (SAST) 7I don't feel compelled to use them in the IDE.  Claude does a great job; it can do SAST and implement security best practices extremely well.

Software Composition Analysis (SCA) focuses on the third-party and open-source components our code relies on.  Claude once again does a great job of identifying vulnerabilities and upgrading to the latest versions.

Security secrets: Claude once again does a great job, especially with remote repo integrations such as GitHub, ADO, and GitLab.

Conclusion:

For enterprises building Azure-hosted web applications and APIs, StackHawk offers a developer-focused DAST approach that integrates directly into modern DevSecOps workflows. Unlike traditional DAST tools, which security teams often operate, StackHawk is designed to work with developers, providing rapid feedback during testing and deployment.  This "shift left" saves time and money. There are various DAST options, but StackHawk has become my favourite.  With the rise of AI coding, developer-level DAST is more important than ever.

BURP has been the standard for pen testing for many years.   Three DAST tools focus on different things: Burp Scanner, OWASP ZAP, and StackHawk.
Wiz API is a great test tool for API Security: runtime security, covering much of the same area as StackHawk for API security, but its key differentiator is runtime threat detection.

GIT Intro

Overview: Git is is very popular and it is similar to existing version control systems.  The key is to be able to work on multiple branches that you can go to at any point.

Let's get started..

Start a new Git repository (repo) - all folders created under the main git folder are part of the repository. Any changes are kept track of and all change history is recorded.  The new repo has a default main branch created automatically.  To create a new repo use the syntax:

>git init

There are files you don't want to keep track of in the repo, so use the .gitignore files or folders to skip specific files from being tracked int he repo.

Once you are writing code, you get a Git local staging area.  -A means All files and folders

>git add -A

Now you make changes in your staging environment via your IDE, and need to add it back to the default "Main" branch.

Create a repo, add code, change code and commit to the branch.

This is a fantastic simple illustration to quickly understand Git.

GitHub is Git hosted (centrally hosted instances, bought by Microsoft circa 2018 but still open source, https://github.com), the developer clones the GitHub repository and works using a distributed source control.  You can host yourself but has great integration with Azure DevOps.   You can also replace the central GitHub with Azure DevOps (Git).

• Git ignore files, tells source control not to include certain file types
• Tags for a specific point in time.  Like labels in TFS/Azure DevOps
• Pull request (PR) - dev made change, and wants to push the code into main branch, someone else generally approves and the code is pulled into the main (Working Directory) branch (depends on branching strategy)
• Developer normally branches of Main branch using a cloned copy on local dev env.  The Developer does changes, then does a PR, the PR if approved gets approved it gets merged into Main (automatically or manually per config), Main branch has the latest code and the developer can delete their cloned branch.
• GitHub Enterprise allows integration with Microsoft Teams (sounds amazing)
• GitHub Codespaces - Instead of local dev, it allows dev using a browser.  Competes with Microsoft's Dev Box (spins up dev env that is browser accessible).  Microsoft Dev Box iGB VM's to choose from, the 16GB, has 4 vCPU's.  Only bills when DevBox is running but the storage used is continuous.  If left on/max monthly cost, it would cost about £370, if well managed i.e. turned off on weekend and overnight but used for roughly 8 hrs a day cost would be around £85 for a month.  All dev licences are included.  Pls check with Ms this is my understanding.

DevOps has morphed into DevSecOps (Development, Security, Operations) - same team responsible for all the roles.  Continuously ensure security built in, call shifting left so it is not tact on at the end of the project.  Includes monitoring and auditing.  Git like other source control systems assists in DevSecOps.