Dynamic Application Security Testing (DAST) runs PEN tests like scans of your application.
The test uses OWASP ZAProxy (https://github.com/zaproxy/zaproxy) to scan a running instance in your web application. It runs a passive scan, which means it only tries to discover your application by exploring links, will not find links created dynamically, and will not attack your application actively.
Before GitLab 12.0, this scan also used the Docker-in-Docker mechanism, but now it just retrieves and runs a container and the test. This means the image is cached on GitLab runners, and after retrieving the image for the first time, the security test will run faster.
As with SAST, you control how scanning happens through the .gitlab-ci.yml file, as follows:
dast:
image: registry.gitlab.com/gitlab-org/security-products/zaproxy
variables:
website: "...