GitHub and StackHawk Office Hours: Code to Runtime Application Security

### Overview In this office hours session, the StackHawk team—featuring Morgan, Scott, Brian, and April—explores how integrating StackHawk's dynamic application security testing (DAST) with GitHub and GitHub Advanced Security (GHAS) bridges the gap between code-level development and runtime security. Rather than treating application security as a reactive, firefighting exercise after code reaches production, the presentation outlines how teams can proactively find and fix API and web application vulnerabilities directly within their continuous integration and continuous deployment (CI/CD) pipelines.

### Key Topics - **Complementary Security Testing Models (SCA, SAST, and DAST):** The speakers contrast Dependabot (software composition analysis / SCA) and CodeQL (static application security testing / SAST) with StackHawk (DAST). Dependabot flags known vulnerable third-party dependencies (CVEs), while CodeQL identifies vulnerable patterns and code smells in static source code with precise line-of-code tracking, though it can generate false positives. StackHawk tests running applications, validating exploitability in runtime with low false positives. - **AI-Powered API Discovery:** StackHawk connects directly to GitHub repositories as a source of truth. It analyzes codebases, detects frameworks, commit frequency, and recent committers, and catalogs web applications, APIs, GraphQL, and gRPC endpoints to provide visibility into attack surfaces and track testing coverage. - **GitHub Actions & Pull Request Checks:** Using the official HawkScan action, teams can execute automated dynamic scans against ephemeral preview environments or local application instances in CI/CD. Test results and breaking vulnerabilities (based on OWASP severity ratings) are commented directly into pull requests. - **Unified Security Dashboards via Updated SARIF:** StackHawk worked with GitHub and Microsoft to update the SARIF standard, enabling DAST findings to publish alongside static findings directly in the GitHub Advanced Security code scanning dashboard. - **SAST and DAST Correlation:** StackHawk matches dynamic findings to static CodeQL findings using Common Weakness Enumeration mappings (such as CWE-89 for SQL injection). This pairs runtime proof of exploitability with the exact line of code requiring remediation.

### Technical Details During the live demonstration, April showcases a Node.js Express application (`Vuln Node Express`) configured with a GitHub Actions workflow (`.github/workflows/HawkScan.yml`). The workflow installs Node.js, installs dependencies, runs unit tests, boots the application locally in the background, and runs `HawkScan` using API credentials, branch name, and commit SHA. The scan is configured to generate SARIF artifacts and fail builds when high-severity vulnerabilities are detected. In the demo, StackHawk flags high-severity SQL injection and cross-site scripting (XSS) issues on the `/search` endpoint. By integrating with CodeQL via GitHub APIs and matching CWE-89, the platform reveals curl-reproducible runtime request/response evidence alongside the exact file and line (`search.js`, line 6).

### Takeaways Deploying developer-friendly DAST in pre-production pipelines eliminates the overhead of managing IAST/RASP agents and allows teams to test without interference from production mitigations such as rate limiters. By surfacing actionable, curl-reproducible proof in pull request comments and linking dynamic exploits to static code lines, organizations can efficiently prioritize remediation, reduce dashboard fatigue, and deploy secure software rapidly across microservices and cloud environments.