I'm a penetration tester working on a CI/CD integration with Checkmarx. I understand the basics, but I need guidance on three areas: securely managing pipeline secrets, running authenticated scans against applications that use Okta, and capturing application traffic so it can be used during scanning. I'd also like to understand which parts differ between SAST and DAST, since the authentication and traffic-capture requirements seem specific to DAST.
4 Answers
To capture traffic, run automated browser tests against the application through an intercepting proxy such as ZAP or Burp in a controlled test environment. The browser exercises the login and important workflows, the proxy records the requests, and the resulting session or traffic can be supplied to the DAST process. This often works better than relying only on the scanner’s crawler, especially for single-page applications and complex Okta flows. Make sure captured data is sanitized and never contains real user information or production credentials.
For an Okta-protected DAST target, don’t depend on manually automating an interactive login on every pipeline run if you can avoid it. A dedicated test account, a scanner-supported bearer token, or a reusable authenticated session is usually more reliable. Coordinate with the identity team about MFA and conditional-access policies, and restrict the test account to a non-production environment. Pass the session or authorization header to the scanner through the pipeline’s protected runtime configuration rather than exposing it in logs.
For pipeline authentication, use the CI platform’s supported OIDC integration to authenticate to your cloud provider, then fetch the Checkmarx credentials from the cloud secret manager. This is generally easier to rotate and audit than storing permanent repository secrets. If repository secrets are used, reference them by name in the workflow and ensure the associated Checkmarx identity has only the permissions needed to start scans and retrieve results.
First clarify which Checkmarx product and scan type you’re integrating. SAST analyzes source code, so authenticated browsing and captured traffic aren’t relevant. Those are DAST concerns. For secrets, KMS is mainly an encryption service rather than a complete secret store. Put tokens and credentials in something like AWS Secrets Manager or SSM Parameter Store, then retrieve them at runtime through the pipeline using short-lived cloud credentials. Avoid hardcoding values in YAML or relying on long-lived static credentials.
Repository secrets can work for a small setup, but they’re difficult to manage because they have little metadata and are effectively write-only. Using OIDC plus a cloud secret store gives you better rotation, auditing, and access control.