Hello,
currently Im struggling to find out best solution when doing DAST for APIs.
Right now I have 5 different OpenAPI spec files which I need to scan through.
My current setup is, having different stages per API Spec file so:
stages:
- dast_openapi1
- dast_openapi2
...
However with this, each stage overwrites previous one so 4/5 are missing or marks the vulnerabilities from previous stages as Remediated because they are not found in other API spec.
I have tried to add separate final stage for the reporting, which simply combines all of the gl-dast-api-report.json from previous stages into one final file and then reports it. However with this, syntax is the issue as only issues from first stage are reported.
Does anyone have an experience with doing API DAST with multiple OpenAPI spec files?
Thanks