Web application DAST automation with OWASP ZAP baseline scans

DAST is useful when it is fast enough to run regularly and scoped enough to avoid chaos. I use baseline scans on pull request environments to catch missing headers, obvious injection risk, and regressions in exposed attack surface. It is not a substitute for review, but it is a useful net.