v2.2.0: lean BApp build — remove native-duplicating checks, cross-reference instead

[liam-portswigger]

What & why

Repositions the extension as the lean, BApp-Store build: it now covers only the API-specific OWASP categories Burp's native scanner does not already test. Native duplication is the single most common BApp-Store rejection reason, so the duplicating checks are removed here and cross-referenced statically instead.

DAST cannot read or add to the site map, so dynamic cross-referencing (audit-issue listener, own issue table) is not possible — confirmed with PortSwigger review. The viable approach is a static "Related Burp Scanner checks" line on the surviving part-overlap issues plus a README/DAST-guide OWASP → native mapping.

The complete re-detecting build (15 checks) is preserved on the full branch and the v2.1.2 tag for anyone who wants a one-extension sweep and accepts the overlap.

Removed (duplicated the native scanner)

Removed check	Native coverage to use instead
InjectionCheck (+ injection/ helpers)	SQL / OS command / JS injection, reflected XSS
SsrfCheck	Out-of-band resource load (HTTP), file path traversal
MethodFuzzingCheck	HTTP TRACE / PUT method enabled
BrokenAuthCheck	JWT checks, unencrypted communications
FunctionLevelAuthCheck	Broken access control
SecurityMisconfigCheck	CORS, CSP, HSTS, clickjacking, source disclosure

Trimmed part-duplicates

• BrokenObjectAuthCheck — dropped the unauthenticated-access sub-test (that's native Broken access control). ID-manipulation and enumeration now require a different object vs baseline (content comparison), not just a 2xx — which is what justifies Firm confidence on a single observation. Adds a Related Burp checks line.
• ExcessiveDataExposureCheck — dropped sensitive-field-by-name detection (native reports specific value leaks at higher confidence). Keeps the response-shape signals native doesn't: unbounded arrays, excessive field counts. Adds a Related Burp checks line.

Confidence / severity adjustments

• MassAssignmentCheck — combo + priv-esc issues now note echoed ≠ persisted; combo lowered Critical/Certain → High/Firm.
• ResourceConsumptionCheck — large-response Medium/Certain → Low/Tentative; missing-rate-limit → Information/Tentative.
• UnsafeApiConsumptionCheck — webhook pointer Medium → Information.
• ParameterPollutionCheck — reverts the v2.1.2 over-correction that suppressed 2xx → 4xx. For HPP, a marker-induced 200 → 400 means the server reads the last value and discards the legitimate first one — a genuine override primitive (a reviewer confirmed a suppressed case was real). Now fires on any status change, kept at Tentative.
• InventoryManagementCheck — dropped /v1/ from the deprecated pattern (it's the current version on most APIs → false positive on nearly every modern API); dropped /swagger, /api-docs, /openapi from debug paths (intentional published docs, overlap native).

Docs

• README and BURP_DAST_GUIDE lead with scope and an explicit OWASP → native mapping.
• VALIDATION_GUIDE rewritten for the 9 lean checks (removed-check entries gone; BOLA/EDE/HPP entries updated).
• CLAUDE.md documents the main (lean, 9 checks) vs full (15 checks) split and fixes the HPP row in the detection-discipline checklist (it previously encoded the over-correction this PR reverts).
• Version 2.1.2 → 2.2.0 across pom.xml, CI, banner, and docs.

Verification

• mvn clean package -DskipTests is clean; default build produces burp-api-scanner-2.2.0.jar (the BApp pipeline builds the default).
• Check inventory: 4 active + 5 passive = 9.

🤖 Generated with Claude Code