Web & application
DAST
Dynamic Application Security Testing
Testing a running application from the outside by sending crafted requests and observing responses for signs of vulnerabilities.
DAST scanners (OWASP ZAP, Burp Suite) crawl a deployed app, then fuzz parameters with payloads for injection, XSS, open redirects and misconfigured headers, judging success by the response. They need no source access and test the real stack, including the web server and framework config.
Limits: coverage depends on the crawler reaching pages (authenticated flows and SPAs are hard), business-logic and authorisation bugs like BOLA are mostly invisible, and scans are slow, so they suit staging or nightly runs rather than every pull request. Never point an aggressive scan at production without agreement.