Docker API Scan in GitLab - WARN-NEW or FAIL-NEW are not reflected in the output

[michal]

Hi Team,

I am running OWASP ZAP API scan in GitLab from docker image (owasp/zap2docker-stable). There are alerts in the ZAP Scanning Report:

But there are no WARN-NEW or FAIL-NEW in the output:



Can I ask if anyone has encountered this?

Thanks.

Michal

[Simon Bennetts]

Have a look at the URLs of the alerts in the report.

By default the report includes everything, including alerts for URLs that are strictly speaking out of scope.

The packaged scans will only report issues that are under the URL you specified.

Cheers,

Simon