StackHawk
Developer-first DAST platform configured as code for CI/CD pipelines.
Technical Architecture & Overview
StackHawk runs DAST scans defined in a stackhawk.yml file in the repository, executed in CI as containers, with findings surfaced in pull requests and remediation guidance. The HawkScan Test Engine was re-engineered from its ZAP origins into a container-first scanner as of v4.0. API scanning uses OpenAPI, GraphQL, and gRPC specifications. The product targets engineering teams rather than security service consoles.
Targeted Technical Use Cases
Engineering teams adding DAST to pipelines without standing up a separate scanner program.
Evaluation & Trade-offs
Core Strengths
- +CI-native with configuration-as-code.
- +Spec-driven API scanning.
- +Findings land where developers already work.
Trade-Offs & Limitations
- -Depth depends on the ZAP engine underneath.
- -Enterprise program features are lighter than Invicti-class platforms.
Defensive Security Application
Automated dynamic testing on every pipeline run, catching regressions before release.
Frequently Asked Questions
What is StackHawk?→
StackHawk runs DAST scans defined in a stackhawk.yml file in the repository, executed in CI as containers, with findings surfaced in pull requests and remediation guidance. The HawkScan Test Engine was re-engineered from its ZAP origins into a container-first scanner as of v4.0. API scanning uses OpenAPI, GraphQL, and gRPC specifications. The product targets engineering teams rather than security service consoles.
What is StackHawk used for?→
Engineering teams adding DAST to pipelines without standing up a separate scanner program.
What are the strengths of StackHawk?→
- +CI-native with configuration-as-code.
- +Spec-driven API scanning.
- +Findings land where developers already work.
What are the limitations of StackHawk?→
- +Depth depends on the ZAP engine underneath.
- +Enterprise program features are lighter than Invicti-class platforms.
How is StackHawk used defensively?→
Automated dynamic testing on every pipeline run, catching regressions before release.