pal-e-docs

Phase 20d: Web App Scanning (OWASP ZAP)

phase-platform-20d-webapp-scanning Phase

phase
Project

Phase 20d: Web App Scanning (OWASP ZAP)

Goal: Scheduled OWASP ZAP baseline scans against all public-facing endpoints. Catches OWASP Top 10 vulnerabilities (XSS, injection, broken auth, etc.) before users do.
Owner: Dev agent
Repo: forgejo_admin/pal-e-platform
Depends on: Phase 14 (Synthetic Monitoring — ZAP scans the same Tailscale funnel endpoints)
DORA: CFR — web app vulnerabilities that ship to production are change failures. Catching them in a scheduled scan prevents user-facing incidents.

Scope

  • Deploy OWASP ZAP baseline scan as k8s CronJob (weekly schedule)
  • Target all Tailscale funnel endpoints (Forgejo, Harbor, Grafana, pal-e-app, westside-app, Keycloak)
  • ZAP baseline scan mode (passive — spider + passive rules, no active fuzzing initially)
  • Results parsing: ZAP JSON report → Prometheus metrics (alert count by severity) OR log-based alerting via Loki
  • Alert on new HIGH or CRITICAL findings via Alertmanager
  • Grafana panel: vulnerability count by severity, trending over time
  • SOP: sop-vuln-triage — how to triage ZAP findings, exception process for false positives
  • Future: graduate from baseline (passive) to full scan (active fuzzing) once false positive rate is manageable

Deliverables

  • TBD — filled after completion
  • phase-platform-20-security-deepening — parent phase
  • phase-pal-e-platform-14-synthetic-monitoring — ZAP targets same endpoints as Blackbox probes
  • phase-pal-e-platform-vuln-scanning — Phase 10, ZAP complements Trivy (images) with webapp scanning
  • plan-pal-e-platform — parent plan