How OnPrintShop Strengthened Product Security with ZeroThreat’s Automated DAST

OnPrintShop is a mature SaaS product serving a global customer base in the printing and personalization industry. Its platform includes:

• Complex web workflows
• Multiple user roles and permissions
• Extensive form-based inputs
• Continuous feature evolution across releases

Given this complexity, ensuring protection against common yet impactful web vulnerabilities—especially client-side issues—became a key product responsibility.

As the product evolved, the OnPrintShop team faced a familiar challenge for large SaaS applications:

1. Broad attack surface across pages and inputs

With numerous pages, forms, and input parameters, detecting client-side vulnerabilities consistently through manual reviews was difficult and time-consuming.

2. Security validation tied to release cycles

Security checks needed to align with planned releases, without introducing uncertainty or disruption to the roadmap.

3. Need for confidence, not disruption

The team did not want security tooling to slow development or force major workflow changes. The goal was confidence and stability, not speed at any cost.

OnPrintShop adopted ZeroThreat primarily for its DAST capabilities, with a focus on identifying real, exploitable application-level vulnerabilities aligned with the OWASP Top 10.

ZeroThreat was selected because it:

• Effectively detects client-side vulnerabilities, especially XSS
• Provides clear visibility into OWASP Top 10 risks
• Fits naturally into an existing release process
• Requires minimal onboarding and configuration

The tool is used as a pre-release security validation layer, giving the team clarity before deployments.

Before ZeroThreat	After ZeroThreat
Security validation relied largely on manual reviews	Automated DAST used as part of the release process
Client-side vulnerabilities hard to detect at scale	XSS and OWASP Top 10 issues identified more reliably
Limited visibility into security posture before release	Clear security insights available prior to production
Security checks loosely tied to release cycles	Structured pre-release security validation
Uncertainty around security risks in production	Greater confidence in product stability and security posture

When scans are run

• Before release, as part of the release process
• Executed every 4–5 months, aligned with the product roadmap

How findings are handled

• Vulnerabilities are reviewed and prioritized based on severity
• Critical and high-severity issues are addressed immediately
• Lower-severity or complex issues are planned into subsequent releases
• Fixes are implemented without disrupting the overall roadmap

This approach keeps security structured, predictable, and manageable.

ZeroThreat has consistently surfaced vulnerabilities aligned with the OWASP Top 10, with particular value in detecting:

• Cross-site scripting (XSS) issues
• Client-side script vulnerabilities spread across multiple pages and inputs

These issues are difficult to identify manually at scale and require automated coverage across the application.

What Mattered Most

Reliable pre-release validation of OWASP Top 10 vulnerabilities—especially XSS—across a complex, input-heavy SaaS application, while maintaining predictable release cycles and improving overall product stability.

After integrating ZeroThreat’s web app pentesting into its release process, OnPrintShop observed clear improvements in security confidence, product stability, and release predictability.

Security & Product Outcomes

• Reliable detection of OWASP Top 10 vulnerabilities before release
• Improved identification of XSS vulnerabilities across complex, input-heavy page structures
• Increased confidence in the product’s security posture prior to production deployments

Workflow & Stability Improvements

• Security validation aligned with the release roadmap
• Improved overall product stability across releases
• Reduced risk of unpredictable security issues in production

Team Confidence

• Clearer understanding of vulnerability severity across teams
• Higher confidence among product and engineering leadership during release sign-offs
• Security insights delivered without additional operational or process overhead

Product owner satisfaction rating: 9 / 10

The rating reflects:

• Ease of use
• Clear and actionable findings
• Improved product stability
• Confidence in addressing security risks proactively