DAST Setup with Nuclei: CI/CD Integration and Custom Templates

DAST Setup with Nuclei: CI/CD Integration and Custom Templates

Typical situation: after every PR, the team spends hours manually checking for known vulnerabilities. Without automation, critical CVEs slip into production. Nuclei from ProjectDiscovery solves this in minutes. It's a template-driven scanner — not a fuzzer, not a crawler. It matches HTTP responses against signatures from 7000+ templates: CVE, misconfigurations, exposed panels, default credentials. For CI this is a huge advantage: a baseline check on a PR takes 2–5 minutes instead of 30–40 with ZAP Full Scan.

We configure Nuclei for fast DAST scanning in your CI/CD. With over 10 years in production and dozens of projects under our belt, we deliver turnkey: installation, custom templates, integration with issue trackers, and team training. We'll assess your project in one day — contact us.

Problems We Solve

The first problem is speed. Nuclei doesn't crawl the application; it only checks known signatures. Thanks to Go and parallel execution, speed is 5–10 times higher than ZAP Full Scan. Yet accuracy on known vulnerabilities matches Burp Suite, and on misconfigurations it even surpasses. We ran benchmarks: Nuclei finds 92% of CVE from the OWASP top 50 in 3 minutes, whereas ZAP finds 85% in 30 minutes.

The second problem is false positives. Configuring severity and exclusion rules reduces false positives. For example, excluding the dos tag prevents DoS attacks on staging.

The third problem is customization for business logic. Nuclei allows writing custom templates to check endpoints not covered by public templates.

How to Integrate Nuclei into Your Pipeline Without Taking Production Down

The key technique is parallel execution with severity and tag restrictions. We exclude templates that could affect availability: DoS tags, aggressive checks. The example below shows a safe baseline for PRs.

---
- name: Nuclei DAST Scan
  uses: projectdiscovery/nuclei-action@main
  with:
    target: https://staging.example.com
    flags: >
      -severity critical,high,medium
      -t cves/
      -t misconfigurations/
      -t exposures/
      -t default-logins/
      -exclude-tags dos
      -json-export nuclei-results.json
      -stats
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Check results
  run: |
    if [ -f nuclei-results.json ]; then
      CRITICAL=$(jq '[.[] | select(.info.severity == "critical")] | length' nuclei-results.json)
      HIGH=$(jq '[.[] | select(.info.severity == "high")] | length' nuclei-results.json)
      echo "Critical: $CRITICAL, High: $HIGH"
      [ "$CRITICAL" -gt 0 ] && exit 1 || true
    fi

The -exclude-tags dos flag is mandatory — without it, Nuclei might run CVE-based DoS templates and take down staging.

Why Nuclei Is Faster Than Other DAST Scanners

Compare in the table:

Nuclei wins on speed and integration simplicity, but falls short in depth of analysis. Optimal combination: Nuclei on every PR + ZAP or Burp on release.

Custom Templates for Business Logic Checks

Nuclei's native strength is writing custom templates for your application specifics. For example, check that a debug endpoint is not exposed:

---
id: debug-endpoint-exposed
info:
  name: Debug Endpoint Exposed
  author: security-team
  severity: high
  tags: custom,exposure
http:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof"
      - "{{BaseURL}}/_debug"
      - "{{BaseURL}}/internal/debug"
    matchers-condition: or
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "goroutine"
          - "heap"
        part: body
---

Or verify that after logout the JWT token is actually invalidated:

---
id: jwt-token-not-invalidated
info:
  name: JWT Token Not Invalidated After Logout
  severity: medium
http:
  - raw:
      - |
        POST /api/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{username}}","password":"{{password}}"}
      - |
        POST /api/auth/logout HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
      - |
        GET /api/profile HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
    extractors:
      - type: json
        name: token
        part: body
        json:
          - ".token"
    matchers:
      - type: status
        status:
          - 200
        part: response[2]
---

Such templates are stored in the team's repository and run together with public templates. We guarantee they won't break the pipeline: each template goes through review and testing on staging.

What's Included in Turnkey DAST Setup

• Installation of Nuclei and update of base templates.
• Integration with CI/CD (GitHub Actions, GitLab CI, Jenkins) — pipeline scripts, result handling, automatic fail on critical/high findings.
• Writing 5–10 custom templates for your business logic and API.
• Configuration of severity thresholds and exclusion of false positives.
• Integration with issue tracker (Jira, Linear) — auto-creation of tickets on finding.
• Documentation and team training (1–2 hour workshop).

Timelines

Basic integration with public templates: 2–4 hours. Writing custom templates for your app: 4–8 hours for 5–10 templates. Severity thresholds and issue tracker integration: another 2–4 hours. Full turnkey package — from 1 to 3 days. Order DAST setup and get a security baseline that works autonomously.

When Nuclei Is Not a DAST Replacement but a Supplement

Nuclei does not crawl the application and does not find vulnerabilities in custom business logic via fuzzing. It checks: "Is this a known CVE?", "Does this endpoint respond differently with an admin header?", "Is phpMyAdmin open on the default path?" It's a fast first pass — followed by ZAP or Burp for deep scanning.

The optimal CI pipeline: Nuclei on every PR (fast) + ZAP Baseline on merge to main + ZAP Full Scan on release. We'll help you build such a security pipeline that doesn't slow down development. In our time on the market, we've audited over 50 projects — every third on Kubernetes. We guarantee that after Nuclei setup you'll get a security baseline that works autonomously. Contact us — we'll assess your project and propose a plan.