Skip to content

Issue replay

Issue replay automatically re-checks existing open findings from previous DAST scans on the target profile. The scanner re-runs the relevant security tests to reproduce and validate each vulnerability. When a finding is still reproducible, the scan emits updated evidence linked to the original issue.

Supported assets

Issue replay is supported on DAST profiles for:

  • Frontend web applications
  • REST API services
  • GraphQL API services

Execution respects the same authentication and scope settings as your DAST configuration for that asset (including allowlists and blocklists merged across frontend and API scopes).

What issues are replayed

Automatic replay (during scans)

Escape replays all MEDIUM and HIGH open findings from previous scans that were not automatically re-detected in the current scan. This may result in longer scans.

Manual replay

Beta Feature

Manual issue replay is currently in beta. While fully functional, we are actively gathering feedback and making improvements.

From the Escape UI, you can replay any existing finding to re-run detection against your live application. This is especially useful after deploying a fix: replay confirms whether the vulnerability is still reproducible, so you can validate that the patch worked before marking the issue as resolved.

You can trigger replay for any issue through the UI, regardless of severity or status. This is useful for:

  • Targeting specific issues you want to validate immediately after a fix
  • Rechecking RESOLVED issues that may have reappeared

Manual replay respects the same authentication and scope settings as your DAST configuration.