{"action":"created","comment":{"url":"https://api.github.com/repos/18F/before-you-ship/pulls/comments/50285546","id":50285546,"diff_hunk":"@@ -5,29 +5,58 @@ parent: Security\n \n [OWASP ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) is the tool we use for doing automated vulnerability scanning.\n \n+<img src=\"../../assets/images/zap_home.png\" alt=\"zap home screen\"/>\n+\n ## Usage\n \n-You will need a running application to test, which you will want to be as production-like as possible. Before testing, make sure to let your team know, as they may see a spike in requests and errors.\n+You will need a running application to test, which you will want to be as production-like as possible. The 'Attack' scripts shouldn't do anything destructive, but will cause a spike in requests and errors. **Inform your team and #devops before running it on live (not locally-hosted) sites.**\n \n 1. [Install the ZAP desktop app](https://github.com/zaproxy/zaproxy/wiki/Downloads).\n 1. In the Quick Start tab, enter the URL of your application.\n     * While you will need to run against production for the official ATO, you can also try out ZAP running against a local server.\n-        * If you're using Rails on Mac, start it with\n-\n-            ```bash\n-            rails server --binding 0.0.0.0\n-            ```","path":"_pages/security/dynamic-scanning.md","position":18,"original_position":18,"commit_id":"fb4f674c12a8bf68aee21e7f5c18ba53442789ef","original_commit_id":"fb4f674c12a8bf68aee21e7f5c18ba53442789ef","user":{"login":"afeld","id":86842,"avatar_url":"https://avatars.githubusercontent.com/u/86842?v=3","gravatar_id":"","url":"https://api.github.com/users/afeld","html_url":"https://github.com/afeld","followers_url":"https://api.github.com/users/afeld/followers","following_url":"https://api.github.com/users/afeld/following{/other_user}","gists_url":"https://api.github.com/users/afeld/gists{/gist_id}","starred_url":"https://api.github.com/users/afeld/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afeld/subscriptions","organizations_url":"https://api.github.com/users/afeld/orgs","repos_url":"https://api.github.com/users/afeld/repos","events_url":"https://api.github.com/users/afeld/events{/privacy}","received_events_url":"https://api.github.com/users/afeld/received_events","type":"User","site_admin":false},"body":"Mind if we keep this in? It's an unusual way of starting Rails, so want to make sure we have a note about it.","created_at":"2016-01-20T17:13:37Z","updated_at":"2016-01-20T17:13:37Z","html_url":"https://github.com/18F/before-you-ship/pull/87#discussion_r50285546","pull_request_url":"https://api.github.com/repos/18F/before-you-ship/pulls/87","_links":{"self":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/comments/50285546"},"html":{"href":"https://github.com/18F/before-you-ship/pull/87#discussion_r50285546"},"pull_request":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/87"}}},"pull_request":{"url":"https://api.github.com/repos/18F/before-you-ship/pulls/87","id":56549789,"html_url":"https://github.com/18F/before-you-ship/pull/87","diff_url":"https://github.com/18F/before-you-ship/pull/87.diff","patch_url":"https://github.com/18F/before-you-ship/pull/87.patch","issue_url":"https://api.github.com/repos/18F/before-you-ship/issues/87","number":87,"state":"open","locked":false,"title":"Fleshing out the zap page.","user":{"login":"DavidEBest","id":933586,"avatar_url":"https://avatars.githubusercontent.com/u/933586?v=3","gravatar_id":"","url":"https://api.github.com/users/DavidEBest","html_url":"https://github.com/DavidEBest","followers_url":"https://api.github.com/users/DavidEBest/followers","following_url":"https://api.github.com/users/DavidEBest/following{/other_user}","gists_url":"https://api.github.com/users/DavidEBest/gists{/gist_id}","starred_url":"https://api.github.com/users/DavidEBest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DavidEBest/subscriptions","organizations_url":"https://api.github.com/users/DavidEBest/orgs","repos_url":"https://api.github.com/users/DavidEBest/repos","events_url":"https://api.github.com/users/DavidEBest/events{/privacy}","received_events_url":"https://api.github.com/users/DavidEBest/received_events","type":"User","site_admin":false},"body":"* Moved the images into assets/images\r\n* Added images to the zap page.\r\n* Added more description of the Examining Results, Authentication, Other Tools, and More Info sections.","created_at":"2016-01-20T00:54:12Z","updated_at":"2016-01-20T17:13:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f99be713a36274e55dddbfa384b72e40ceebe588","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/18F/before-you-ship/pulls/87/commits","review_comments_url":"https://api.github.com/repos/18F/before-you-ship/pulls/87/comments","review_comment_url":"https://api.github.com/repos/18F/before-you-ship/pulls/comments{/number}","comments_url":"https://api.github.com/repos/18F/before-you-ship/issues/87/comments","statuses_url":"https://api.github.com/repos/18F/before-you-ship/statuses/fb4f674c12a8bf68aee21e7f5c18ba53442789ef","head":{"label":"18F:more-zap","ref":"more-zap","sha":"fb4f674c12a8bf68aee21e7f5c18ba53442789ef","user":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":28925549,"name":"before-you-ship","full_name":"18F/before-you-ship","owner":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/before-you-ship","description":"requirements for shipping products","fork":false,"url":"https://api.github.com/repos/18F/before-you-ship","forks_url":"https://api.github.com/repos/18F/before-you-ship/forks","keys_url":"https://api.github.com/repos/18F/before-you-ship/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/before-you-ship/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/before-you-ship/teams","hooks_url":"https://api.github.com/repos/18F/before-you-ship/hooks","issue_events_url":"https://api.github.com/repos/18F/before-you-ship/issues/events{/number}","events_url":"https://api.github.com/repos/18F/before-you-ship/events","assignees_url":"https://api.github.com/repos/18F/before-you-ship/assignees{/user}","branches_url":"https://api.github.com/repos/18F/before-you-ship/branches{/branch}","tags_url":"https://api.github.com/repos/18F/before-you-ship/tags","blobs_url":"https://api.github.com/repos/18F/before-you-ship/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/before-you-ship/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/before-you-ship/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/before-you-ship/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/before-you-ship/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/before-you-ship/languages","stargazers_url":"https://api.github.com/repos/18F/before-you-ship/stargazers","contributors_url":"https://api.github.com/repos/18F/before-you-ship/contributors","subscribers_url":"https://api.github.com/repos/18F/before-you-ship/subscribers","subscription_url":"https://api.github.com/repos/18F/before-you-ship/subscription","commits_url":"https://api.github.com/repos/18F/before-you-ship/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/before-you-ship/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/before-you-ship/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/before-you-ship/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/before-you-ship/contents/{+path}","compare_url":"https://api.github.com/repos/18F/before-you-ship/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/before-you-ship/merges","archive_url":"https://api.github.com/repos/18F/before-you-ship/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/before-you-ship/downloads","issues_url":"https://api.github.com/repos/18F/before-you-ship/issues{/number}","pulls_url":"https://api.github.com/repos/18F/before-you-ship/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/before-you-ship/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/before-you-ship/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/before-you-ship/labels{/name}","releases_url":"https://api.github.com/repos/18F/before-you-ship/releases{/id}","created_at":"2015-01-07T17:33:28Z","updated_at":"2016-01-11T15:43:13Z","pushed_at":"2016-01-20T15:04:49Z","git_url":"git://github.com/18F/before-you-ship.git","ssh_url":"git@github.com:18F/before-you-ship.git","clone_url":"https://github.com/18F/before-you-ship.git","svn_url":"https://github.com/18F/before-you-ship","homepage":"https://pages.18f.gov/before-you-ship/","size":1949,"stargazers_count":3,"watchers_count":3,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":25,"forks":3,"open_issues":25,"watchers":3,"default_branch":"18f-pages"}},"base":{"label":"18F:18f-pages","ref":"18f-pages","sha":"6d18aa015e95a023e09c50c2a0c660ac1d329edf","user":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":28925549,"name":"before-you-ship","full_name":"18F/before-you-ship","owner":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/before-you-ship","description":"requirements for shipping products","fork":false,"url":"https://api.github.com/repos/18F/before-you-ship","forks_url":"https://api.github.com/repos/18F/before-you-ship/forks","keys_url":"https://api.github.com/repos/18F/before-you-ship/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/before-you-ship/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/before-you-ship/teams","hooks_url":"https://api.github.com/repos/18F/before-you-ship/hooks","issue_events_url":"https://api.github.com/repos/18F/before-you-ship/issues/events{/number}","events_url":"https://api.github.com/repos/18F/before-you-ship/events","assignees_url":"https://api.github.com/repos/18F/before-you-ship/assignees{/user}","branches_url":"https://api.github.com/repos/18F/before-you-ship/branches{/branch}","tags_url":"https://api.github.com/repos/18F/before-you-ship/tags","blobs_url":"https://api.github.com/repos/18F/before-you-ship/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/before-you-ship/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/before-you-ship/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/before-you-ship/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/before-you-ship/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/before-you-ship/languages","stargazers_url":"https://api.github.com/repos/18F/before-you-ship/stargazers","contributors_url":"https://api.github.com/repos/18F/before-you-ship/contributors","subscribers_url":"https://api.github.com/repos/18F/before-you-ship/subscribers","subscription_url":"https://api.github.com/repos/18F/before-you-ship/subscription","commits_url":"https://api.github.com/repos/18F/before-you-ship/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/before-you-ship/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/before-you-ship/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/before-you-ship/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/before-you-ship/contents/{+path}","compare_url":"https://api.github.com/repos/18F/before-you-ship/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/before-you-ship/merges","archive_url":"https://api.github.com/repos/18F/before-you-ship/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/before-you-ship/downloads","issues_url":"https://api.github.com/repos/18F/before-you-ship/issues{/number}","pulls_url":"https://api.github.com/repos/18F/before-you-ship/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/before-you-ship/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/before-you-ship/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/before-you-ship/labels{/name}","releases_url":"https://api.github.com/repos/18F/before-you-ship/releases{/id}","created_at":"2015-01-07T17:33:28Z","updated_at":"2016-01-11T15:43:13Z","pushed_at":"2016-01-20T15:04:49Z","git_url":"git://github.com/18F/before-you-ship.git","ssh_url":"git@github.com:18F/before-you-ship.git","clone_url":"https://github.com/18F/before-you-ship.git","svn_url":"https://github.com/18F/before-you-ship","homepage":"https://pages.18f.gov/before-you-ship/","size":1949,"stargazers_count":3,"watchers_count":3,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":25,"forks":3,"open_issues":25,"watchers":3,"default_branch":"18f-pages"}},"_links":{"self":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/87"},"html":{"href":"https://github.com/18F/before-you-ship/pull/87"},"issue":{"href":"https://api.github.com/repos/18F/before-you-ship/issues/87"},"comments":{"href":"https://api.github.com/repos/18F/before-you-ship/issues/87/comments"},"review_comments":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/87/comments"},"review_comment":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/18F/before-you-ship/pulls/87/commits"},"statuses":{"href":"https://api.github.com/repos/18F/before-you-ship/statuses/fb4f674c12a8bf68aee21e7f5c18ba53442789ef"}}}}