Control plane
Cloudflare Worker APIs and D1-backed records for targets, queued scans, and returned results.
A security testing product with clear evidence boundaries.
Early-stage software for authorized security testing. Safeguards reduce risk; they do not guarantee zero impact.
What the product does today
MIAN DAST connects a Cloudflare control plane to a Python scanner that runs on operator-managed machines. A queued scan is not evidence that a target was tested: the agent must claim the job, execute requests, complete the run, and return findings.
Current Python checks are read-only. Expanded mode enables more implemented checks while still blocking state-changing HTTP methods and destructive probes. Destructive DAST, CI build gates, automated code fixes, auditor certification, and a continuously online agent are not currently product capabilities.
Scan execution
A separately operated Python agent claims authorized work and runs the currently implemented checks.
Other workflows
Repository scanning and DNS/HTTP discovery are separate from Python-agent DAST and have their own coverage limits.
Scan only assets you own or are explicitly authorized to test. Review target scope and request limits, prefer a staging environment, and monitor the target during testing. Findings and remediation guidance require operator review.