# draventis

> Markdown source of https://docs.magmamoose.com/draventis/.

Scheduled **DAST** (Dynamic Application Security Testing) for Kubernetes:
[OWASP ZAP](https://www.zaproxy.org/) (via the ZAP Automation Framework) +
[Nuclei](https://github.com/projectdiscovery/nuclei) run on a schedule against
your already-deployed targets, with results reimported into
[DefectDojo](https://www.defectdojo.org/).

Deploy it to any cluster with Helm, point it at your URLs, and it does the rest.

## What it does

draventis is an **orchestrator + uploader**. It runs as one or more Kubernetes
CronJobs; on each run it reads `targets.yaml`, scans each target with ZAP (and
optionally Nuclei), and reimports the reports into DefectDojo.

```text
CronJob (nightly / weekly)
  └─ draventis run --schedule <name>
       ├─ for each target: ZAP plan (by policy) → report.xml
       │                    Nuclei (optional)   → report.jsonl
       └─ reimport each report → DefectDojo /api/v2/reimport-scan/
```

## Why DAST

Static analysis reasons about source and artifacts *at rest*. DAST exercises the
**running** app: authN/session bugs, injection reachable only at runtime,
response-header/TLS/cookie posture, CORS, SSRF, live API surface, and drift
between the repo and what's actually deployed. See [Design](https://docs.magmamoose.com/draventis/design/).

## Get started

| I want to… | Go to |
|---|---|
| Deploy it to a cluster with Helm | [Deployment](https://docs.magmamoose.com/draventis/deployment/) |
| Understand `targets.yaml` and chart values | [Configuration](https://docs.magmamoose.com/draventis/configuration/) |
| Run/develop it locally | [Setup](https://docs.magmamoose.com/draventis/setup/) |
| Understand the code | [Architecture](https://docs.magmamoose.com/draventis/architecture/) |
| Understand *why* it's built this way | [Design](https://docs.magmamoose.com/draventis/design/) |

## Status

The orchestration, config model, DefectDojo uploader, ZAP/Nuclei command
building, Helm chart, and container image are implemented and unit-tested.
Validate the end-to-end scan path against your own environment before relying on
it. Start with a single `baseline` target against a safe host.

## License

Apache-2.0.