docs: document Nuclei/ZAP as decided deterministic detectors under the agentic DAST (not yet implemented)

Spec v0.2.1 decision (2026-08-31): keep the agentic DAST/pentest layer, integrate Nuclei then ZAP baseline underneath as deterministic detectors feeding the control-map LUT; offline vuln DB (Trivy/Grype) on the on-prem runner trigger. Clearly marked as planned so the docs stay truthful until the code lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
2026-08-31 15:12:41 +02:00
parent b7b9c812ab
commit 61c6eab54e
3 changed files with 16 additions and 1 deletions
@@ -92,3 +92,7 @@ Filters can be combined. A count indicator shows how many findings match the cur
 ::: tip
 Findings marked as **Confirmed** exploitable were verified with a successful attack payload. **Unconfirmed** findings show suspicious behavior that may indicate a vulnerability but could not be fully exploited.
 :::
+
+## Deterministic detectors (planned)
+
+The DAST engine above is agentic: an LLM drives crawler, browser and testing tools and decides what to try next. That gives depth and code-aware exploitation, but not run-to-run reproducibility. The next step (decided 2026-08-31, not yet implemented) adds two deterministic open-source detectors **under** the agents: **Nuclei** (template checks incl. ICS/OT and default-credential templates) first, then an **OWASP ZAP** baseline scan. Their findings will appear alongside agent findings, carry CWE + compliance `control_refs`, and seed the agent's context so it verifies and chains instead of rediscovering. See [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code).