StackHawk
DAST platform configured as code for CI/CD pipelines.
Technical Architecture & Overview
StackHawk runs DAST scans defined in a stackhawk.yml file in the repository, executed in CI from a Docker container or the command-line tool, with findings and remediation guidance in the StackHawk platform. The HawkScan Test Engine started as an internal fork of ZAP and was re-engineered as of v4.0. API scanning uses OpenAPI, GraphQL, gRPC, JSON-RPC, and SOAP definitions. Its Wingman plan runs testing inside AI coding agents such as Claude Code, Cursor, and GitHub Copilot.
Targeted Technical Use Cases
Engineering teams adding DAST to pipelines.
Evaluation & Trade-offs
Core Strengths
- +CI-native with configuration-as-code.
- +Spec-driven API scanning.
- +Findings land where developers already work.
Trade-Offs & Limitations
- -Depth depends on the HawkScan engine, an internal fork of ZAP.
- -The Wingman plan includes 50 scans per user per month.
Defensive Security Application
Automated dynamic testing on every pipeline run, catching regressions before release.
Frequently Asked Questions
What is StackHawk?→
StackHawk runs DAST scans defined in a stackhawk.yml file in the repository, executed in CI from a Docker container or the command-line tool, with findings and remediation guidance in the StackHawk platform. The HawkScan Test Engine started as an internal fork of ZAP and was re-engineered as of v4.0. API scanning uses OpenAPI, GraphQL, gRPC, JSON-RPC, and SOAP definitions. Its Wingman plan runs testing inside AI coding agents such as Claude Code, Cursor, and GitHub Copilot.
What is StackHawk used for?→
Engineering teams adding DAST to pipelines.
What are the strengths of StackHawk?→
- +CI-native with configuration-as-code.
- +Spec-driven API scanning.
- +Findings land where developers already work.
What are the limitations of StackHawk?→
- +Depth depends on the HawkScan engine, an internal fork of ZAP.
- +The Wingman plan includes 50 scans per user per month.
How is StackHawk used defensively?→
Automated dynamic testing on every pipeline run, catching regressions before release.