Technical notes on web development, DevOps, and AI integration.
1 article
A passive ZAP baseline before a QA backfill wave: zero FAIL, four WARN, and a rule-level delta table proving the new OAuth surface added no alerts.
TL;DR: The ZAP baseline rerun after adding Google OAuth came back clean: zero FAIL, four WARN, 57 PASS. More convincing, every rule-level count versus the prior baseline dropped or stayed flat, verified from the JSON artifact. Since the scan was passive and unauthenticated, these results cover only public pages; admin and API surfaces need their own session.