Extend ZAP scan to provider users and state API M2M (#1467, #1468)#1470

Open

jlkravitz wants to merge 12 commits into

mainfrom

feat/zap-provider-state-scan

Commits on Apr 17, 2026

Extend ZAP scan to provider users and state API M2M (#1467, #1468)

jlkravitz
and
claude
committed

Commits on Apr 22, 2026

Rename state-auth ZAP secrets with _ZAP_ prefix

jlkravitz
and
claude
committed
Simplify ZAP state-auth client provisioning docs

jlkravitz
and
claude
committed
TEMP: trigger ZAP scan on PR events

jlkravitz
and
claude
committed
Pass multi-auth tokens to ZAP container via docker_env_vars

jlkravitz
and
claude
committed
Use ID token for provider ZAP auth

jlkravitz
and
claude
committed
Add body examples for three providers/query endpoints in ZAP enrichment

jlkravitz
and
claude
committed
Narrow state /providers/query example window to 7 days

jlkravitz
and
claude
committed
TEMP: log state /providers/query 400 req/resp for diagnosis

jlkravitz
and
claude
committed
TEMP: log all clean-URL state /providers/query req/resp

jlkravitz
and
claude
committed
Defensive guard for body-example insertion

jlkravitz
and
claude
committed
Add ECDSA signature auth for ZAP state-api scanning

jlkravitz
and
claude
committed