pieceofcake2 / security-dast
Dynamic application security testing of a running CakePHP 2 application with the OWASP ZAP baseline scan, as a PDF report by alert and risk
Requires
- php: >=8.0
- pieceofcake2/report: ^1.0
Requires (Dev)
- cakephp/cakephp-codesniffer: ^5.0
- phpstan/phpstan: ^2.1
- phpunit/phpunit: ^9.6
Suggests
- ext-pcntl: Stops ZAP and removes its files on Ctrl+C and SIGTERM
Provides
None
Conflicts
None
Replaces
None
This package is auto-updated.
Last update: 2026-10-18 16:08:10 UTC
README
Dynamic application security testing of a CakePHP 2 application: the application is run with PHP's built-in web server and scanned by the baseline scan of OWASP ZAP in Docker (security headers, cookies, CSRF tokens of forms, error pages, ...), and the alerts are written as an A4 PDF report by risk in the design of pieceofcake2/report, with an exit code that fails CI. The documentation tells how to fix each alert in a CakePHP 2 application.
composer require --dev pieceofcake2/security-dast vendor/bin/security-dast --pdf=tmp/security-dast.pdf --fail-on=high
Documentation
- Website: https://pieceofcake2.github.io/security-dast/ (日本語: https://pieceofcake2.github.io/security-dast/ja/)
- Markdown: docs/README.md (日本語: docs/ja/README.md) (for AI tools and offline reading)
Requirements
- PHP 8.0+
- Docker (the image of ZAP)
- Google Chrome or Chromium 131+
Installation
composer require --dev pieceofcake2/security-dast
Reporting Issues
Please open an issue on GitHub. To report a security vulnerability, use private vulnerability reporting.
Contributing
See the contribution guidelines.
Origin
This package was created by pieceofcake2, which also maintains it. It is not a fork of another project and is not based on one.
License
The MIT License. See LICENSE.