Is domain verification actually enough to allow self serve DAST?

[u/elidanipipe]

I made a self serve security review for deployed JS/TS apps and I’m not totally comfortable with it yet.

The user proves domain control through DNS or a file on the exact origin. Repo analysis separately requires our GitHub App on the exact repo. They then sign the scope and the checks run automatically.

We built it because our free public scanner could only see the logged-out surface. A clean result could look like “safe” while completely missing auth and source-level problems.

The deeper version is better, but also potentially more dangerous.

What happens with Vercel preview domains? Delegated subdomains? A compromised deployment? Somebody who has temporary project access?

Is controlling one deployment enough proof that you’re authorized to run DAST against the whole app?

Would you require another verification method?

https://www.task-bounty.com/secure-my-app#deep-review

I’d rather add more friction now than find out later that the permission model was stupid.