Phase 3: ZAP DAST Integration & Reliability

[ToryMic]

Phase 3 — ZAP DAST Integration & Reliability

Depends on: Phase 2

Drips Wave alignment

• Mirrors Wave #1034 health check automation for scanner dependency readiness
• Graceful degradation when ZAP unavailable (similar to dependency-unavailable error contracts)

Deliverables

• ZAP spider/AJAX spider timeout hardening in zap_client.py
• Passive scan wait optimisation with progress callbacks
• Active scan policy profiles: quick / standard / deep
• /ready includes ZAP connectivity check when SCANNER_MODE=zap
• Structured DEPENDENCY_UNAVAILABLE error when ZAP down
• Integration tests with mocked ZAP API

Acceptance criteria

• Full lab scan (./start-lab.sh full) completes without timeout on DVWA
• Fallback to builtin logged clearly when ZAP unreachable
• Contract test for dependency-unavailable envelope
• docker compose ps documented in runbook

References

• docker-compose.yml — ZAP on :8081
• Drips #159 API contract tests