StackHawk

StackHawk is a DAST tool built on the OWASP ZAP scanning engine, packaged for CI/CD pipelines. Security tests are configured in a stackhawk.yml file that lives in your repository alongside your code. Scans run in your pipeline, findings go to developers with remediation guidance.

The tool focuses on APIs and modern application architectures. REST, GraphQL, SOAP, and gRPC are all first-class scan targets, not afterthoughts bolted onto a browser-based scanner.

What is StackHawk?

StackHawk takes the ZAP scanning engine and wraps it in a workflow that fits how developers already work. Configuration lives in version control. Scans trigger in CI/CD. Findings include code examples showing how to fix the issue.

The philosophy: security testing belongs in the development process, not bolted on at the end. If you can configure your tests in YAML, version-control them, and run them in a pipeline, security testing gets treated like any other quality check. The OWASP Testing Guide recommends integrating dynamic analysis into CI/CD workflows to catch vulnerabilities before they reach production.

HawkAI, the API discovery feature, scans your source code to find endpoints that may not appear in your OpenAPI spec. It looks at route definitions in frameworks like Express, Spring, Django, and Rails, and flags undocumented or internal APIs that your spec missed.

Key features

Installation

# macOS with Homebrew
brew tap stackhawk/cli
brew install hawk

# Docker
docker pull stackhawk/hawkscan

# Initialize with your API key
hawk init --api-key=YOUR_API_KEY

# Verify
hawk --version

Configuration

Create stackhawk.yml in your project root:

app:
  applicationId: ${STACKHAWK_APP_ID}
  env: ${STACKHAWK_ENV}
  host: ${STACKHAWK_HOST}

hawk:
  spider:
    maxDurationMinutes: 5
  scan:
    maxDurationMinutes: 10

API scanning

# REST via OpenAPI
app:
  openApiConf:
    filePath: openapi/spec.yaml

# GraphQL via introspection
app:
  graphqlConf:
    schemaPath: /graphql
    operation: ALL

Authentication

# Bearer token via external auth
app:
  authentication:
    external:
      type: TOKEN
      value: ${ACCESS_TOKEN}
    tokenAuthorization:
      type: HEADER
      value: Authorization
      tokenType: Bearer

# Cookie-based via external auth
app:
  authentication:
    external:
      type: COOKIE
      name: session
      value: ${SESSION_COOKIE}

Integrations

CI/CD Platforms

GitHub Actions

GitLab CI

Jenkins

CircleCI

Azure Pipelines

AWS CodePipeline

Bitbucket

DevOps & Security

Jira

Slack

Semgrep

Snyk

Endor Labs

Getting started

GitHub Actions example

name: Security Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  stackhawk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Start application
        run: docker-compose up -d
      - name: Run StackHawk scan
        uses: stackhawk/hawkscan-action@v2
        with:
          apiKey: ${{ secrets.STACKHAWK_API_KEY }}
          configurationFiles: stackhawk.yml
          codeScanningAlerts: true
          githubToken: ${{ github.token }}

When to use StackHawk

StackHawk is a natural fit for teams that build API-first applications and practice DevSecOps. If you want security config in version control, scans in CI/CD, and findings that developers can act on, StackHawk delivers that workflow.

The YAML-based configuration means security tests work the same way every time and get reviewed in PRs. The ZAP engine handles vulnerability detection; StackHawk handles the developer experience on top.

It is less suited for teams that need to scan without application source access, organizations heavily invested in traditional browser-rendered apps rather than APIs, or teams requiring fully on-premises deployment. StackHawk is SaaS only. For on-premises or standalone DAST, consider Burp Suite or Nuclei. For a comparison of testing approaches, see SAST vs DAST vs IAST.

A 14-day free trial of the enterprise plan is available, making it practical to evaluate before committing to a paid subscription.

Frequently Asked Questions