# Draventis — scheduled security testing against your deployed targets

> Scheduled dynamic security testing for Kubernetes. OWASP ZAP and Nuclei run against your deployed targets on a schedule, and findings land in DefectDojo.

Canonical: <https://www.magmamoose.com/draventis/> · Last updated: 2026-09-23

Static analysis reads your code. Draventis tests what you actually deployed. OWASP ZAP and Nuclei run against your running targets on a schedule, and the findings land in DefectDojo.

early · v0.1 · Apache-2.0 · Kubernetes

- [View the source](https://github.com/MagmaMoose/draventis)
- [How it works](https://www.magmamoose.com/draventis/#quickstart)

a Magma Moose product · Apache-2.0 open source

*what it does*

## Scan the running thing.

SAST, SCA, IaC scanning and secret detection all reason about source and artifacts at rest. None of them send a request to the deployed system. Draventis covers that half.

### Tests what is deployed

Runtime response headers, TLS, cookie flags, CORS, session handling and injection that is reachable with a working payload. The behaviour, not the source.

### ZAP and Nuclei do the scanning

Draventis is the orchestrator and uploader. OWASP ZAP, driven by its Automation Framework, plus Nuclei as an optional second engine.

### On a schedule, in your cluster

Kubernetes CronJobs, nightly or weekly. DAST needs a running target, and your cluster already runs your apps.

### A policy per target

`baseline` is passive and safe against production. `full` is active and for staging only. `api` works from an OpenAPI spec.

### Reimport, not import

DefectDojo dedupes against the existing test, reactivates regressions and mitigates findings that have gone, so you get what is new and what is fixed without a merge-base.

### An upload never fails a scan

The DefectDojo client is failure-isolated. If the sink is down, the error is logged and the scan result still stands.

Draventis is at **v0.1** and moving quickly, which is earlier than [Diatreme](https://www.magmamoose.com/diatreme/), [Chargate](https://www.magmamoose.com/chargate/) and [Brimyr](https://www.magmamoose.com/brimyr/). It runs, and we run it, but expect the config surface to shift before 1.0.

*how it works*

## Point it at your URLs. It does the rest.

Deploy the chart into any cluster, list your targets, and give it a DefectDojo URL. A CronJob runs each target on its policy and reimports the report.

1. Helm install · 2. List your targets · 3. Read it in DefectDojo

targets.yaml:

```yaml
defaults:
  policy: baseline   # passive, safe against prod
  schedule: nightly

defectdojo:
  url: https://defectdojo.example.com
  close_old_findings: true

targets:
  - name: my-site
    url: https://my-site.example.com
```

## Find it before someone else does.

Free and open source, Apache-2.0 licensed. Runs in your own cluster, against your own targets.

- [View the source](https://github.com/MagmaMoose/draventis)
- [Get help running it](https://www.magmamoose.com/services/)

## Links

- [Draventis: Docs](https://docs.magmamoose.com/draventis/)
- [Draventis: OWASP ZAP](https://www.zaproxy.org/)
- [Draventis: DefectDojo](https://www.defectdojo.org/)
- [Company: Contact](mailto:hello@magmamoose.com)
- [Company: LinkedIn](https://www.linkedin.com/company/magmamoose)