SAST and DAST
Also called static analysis, dynamic scan, OWASP ZAP
Two kinds of automated security check. SAST reads your code without running it. DAST runs your app and attacks it from the outside. Each finds things the other can't.
Both are ready-made sensors for an agent loop. Both miss things: OWASP says static tools have "High numbers of false positives" and struggle with authentication and access control. So a clean scan isn't proof, and in particular it says little about whose data a user can reach.
Say it to your agent
“Add a static scan to CI that fails on new high findings only. Then run ZAP against the local dev server on localhost, and nowhere else. For each finding, show a request that demonstrates it, or mark it as a false positive and say why.”