Freedom251 › Dynamic Application Security Testing Software
SecuDAST
What SecuDAST is
SecuDAST is a self-hosted dynamic security testing product for applications running inside an organization’s network. It tests authenticated flows, APIs, single-page applications, and traditional form-based sites, including internal, staging, and pre-production targets reachable from that network. The engine deploys beside the applications, without cloud scanning infrastructure or sending scan traffic outside the network. Scans default to a safe mode that avoids destructive payloads and rate-limits probing; teams can configure more aggressive checks and exclude paths. Each finding includes the exact request and response that demonstrated it. Results flow to the SecuNexa dashboard with evidence, and standard report formats are available for pipeline and ticketing workflows. Scoped, repeatable scan profiles are intended for pipeline stages or nightly schedules. Named CI systems include GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and self-hosted runners for engines that run as local binaries. The dashboard combines findings from SecuNexa engines into a prioritized workflow inside the organization’s perimeter. It offers seven project-scoped roles, an immutable audit log, local accounts, MFA, and optional LDAP or SSO authentication. SecuNexa says its engines run offline without phone-home telemetry, and vulnerability data arrives through signed offline bundles. The product is aimed at airgapped networks, regulated datacenters, and organizations that cannot upload code to a vendor cloud. Visitors can request a demo; pricing is on request.
Who it suits
SecuDAST suits organizations that need to scan applications inside their own network, including airgapped or regulated environments and teams that cannot upload code to a vendor cloud. Its repeatable profiles and named CI integrations also suit teams that want scans in pipeline stages or on nightly schedules.
What it does well
- Scans authenticated flows, APIs, single-page apps, and traditional sites.
- Runs beside applications without cloud scanning infrastructure.
- Safe mode avoids destructive payloads and rate-limits probing.
- Findings include the request and response that demonstrated them.
- Supports named CI systems including GitHub Actions and Jenkins.
- Dashboard includes project-scoped roles and an immutable audit log.
What to know first
- Pricing is on request.
- The engine is designed to run inside the customer’s network.
- Vulnerability data updates use signed offline bundles that users import.
Limits
Pricing is on request, and the product page directs visitors to request a demo. Scans require targets reachable from the customer’s network; engines run offline and receive vulnerability data through signed bundles that users verify and import.
Getting started
- Visit https://www.secunexa.com/products/dast.
- Request a demo from SecuNexa.
- Deploy the engine beside applications reachable from your network.
- Configure scan profiles, including any aggressive checks or path exclusions needed.
- Connect scans to a supported CI system or schedule them for pipeline stages or nightly runs.
- Import signed offline vulnerability data bundles on your chosen schedule.
Verdict
Choose SecuDAST if your applications need dynamic security testing within your network and you want findings with request and response evidence. It is a fit for controlled CI or scheduled scans; organizations seeking cloud-based scanning should look elsewhere, since the engine deploys beside the applications and does not send traffic out.
Questions
What does SecuDAST scan?
It supports authenticated flows, APIs, single-page applications, and traditional form-based sites, including internal, staging, and pre-production targets reachable from the network.
How much does it cost?
Pricing is on request.
Does it offer a free plan or trial?
The product page directs visitors to request a demo. No free plan or trial terms are provided in these facts.
Can it run in CI/CD?
Yes. Scoped, repeatable scan profiles are intended for pipeline stages or nightly schedules. Named CI systems include GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and self-hosted runners for engines that run as local binaries.
Does scanning send traffic outside the network?
The engine runs beside applications and does not send scan traffic out. SecuNexa says its engines run offline and do not phone home.
How are findings and access handled?
Findings go to the SecuNexa dashboard with evidence, and standard report formats support pipelines and ticketing. The dashboard offers seven project-scoped roles, an immutable audit log, local accounts, MFA, and optional LDAP or SSO authentication.
Facts from SecuDAST's own pages
- CI support
- Scoped, repeatable scan profiles are designed for pipeline stages or nightly schedules. · secunexa.com, 9 Oct 2026
- CI use
- Scoped, repeatable scan profiles are intended for pipeline stages or nightly schedules. · secunexa.com, 8 Oct 2026
- Commercial availability
- The product page directs visitors to request a demo; the pages opened did not state a price, free plan, or trial terms. · secunexa.com, 8 Oct 2026
- Coverage
- The product describes its crawling and testing as built for APIs and dynamic frontends as well as traditional form-based sites. · secunexa.com, 8 Oct 2026
- Dashboard access
- The dashboard supports local accounts, MFA, and optional LDAP/SSO authentication. · secunexa.com, 8 Oct 2026
- Dashboard access controls
- The dashboard offers seven project-scoped roles, including root administrator and read-only, with an immutable audit log for state changes. · secunexa.com, 9 Oct 2026
- Dashboard integration
- The SecuNexa dashboard combines findings from its engines into a prioritized, auditable workflow running inside the organization’s perimeter. · secunexa.com, 9 Oct 2026
- Deployment
- The engine deploys inside the customer’s network without cloud scanning infrastructure or outbound scan traffic. · secunexa.com, 9 Oct 2026
- Evidence
- Each finding includes the exact request and response that demonstrated it. · secunexa.com, 9 Oct 2026
- Integrations
- SecuNexa names GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and self-hosted runners as supported CI systems for engines that run as local binaries. · secunexa.com, 8 Oct 2026
- Intended users
- SecuNexa describes its focus as organizations with airgapped networks, regulated datacenters, or software that cannot be uploaded to a vendor cloud. · secunexa.com, 9 Oct 2026
- Offline updates
- SecuNexa says its engines run without internet access and receive vulnerability data through cryptographically signed offline bundles that users verify and import on their schedule. · secunexa.com, 9 Oct 2026
- Purpose
- SecuDAST performs dynamic security testing of running applications in staging, pre-production, and internal environments inside the customer’s network. · secunexa.com, 9 Oct 2026
- Reporting
- Findings flow to the SecuNexa dashboard with evidence, and standard report formats are available for pipelines and ticketing. · secunexa.com, 8 Oct 2026
- Reports
- Findings flow to the SecuNexa dashboard with evidence, and standard report formats are available for pipelines and ticketing. · secunexa.com, 9 Oct 2026
- Safe scanning
- Scans default to safe mode, avoid destructive payloads, rate-limit probing, and allow sensitive paths to be excluded through scopes. · secunexa.com, 9 Oct 2026
- Security
- SecuNexa says its products do not phone home and engines run offline; vulnerability data is imported through signed offline bundles. · secunexa.com, 8 Oct 2026
- Support
- SecuNexa says customer documentation is provided during onboarding and replies to contact messages within one business day. · secunexa.com, 9 Oct 2026
- Support audience
- SecuNexa describes its platform as built for airgapped networks, regulated datacenters, and organizations that cannot upload code to a vendor cloud. · secunexa.com, 8 Oct 2026
- Targets
- It supports authenticated flows, APIs, and single-page applications, including internal, staging, and pre-production targets reachable from the network. · secunexa.com, 8 Oct 2026
- Target types
- It supports authenticated flows, APIs, and single-page applications. · secunexa.com, 9 Oct 2026
- Telemetry
- SecuNexa says its products do not phone home and have no usage analytics, crash reporting to the vendor, or network license checks. · secunexa.com, 9 Oct 2026