@@ -4104,6 +4104,60 @@ def removed_of(scan: ExternalDastScan) -> list:
         if isinstance(summary, dict) else []
 
 
+def dast_confirmations_for(db, finding) -> list:
+    """Live dynamic findings that point back at one code (SAST) finding.
+
+    A DAST finding names the code finding it matches in ai_sast (the GCR id).
+    When one does, and it was not dismissed, a dynamic scan has shown this exact
+    code weakness is reachable on a running site: it is not only in the code, it
+    is exploitable now.  -> a short list to show on the finding and to warn on
+    before it is waived.  Looks only at the newest done scan of each site linked
+    to the finding's repository, so it is a couple of queries, not a sweep.
+    """
+    from app.core import dast_risk, external_decisions
+    from app.core.models import ExternalAssetRepo, Repository
+
+    vid = (getattr(finding, "vuln_id", "") or "")
+    repo = (getattr(finding, "repository", "") or "")
+    if not vid or not repo:
+        return []
+    repo_row = (db.query(Repository)
+                .filter(Repository.full_name == repo).one_or_none())
+    if repo_row is None:
+        return []
+    asset_ids = [r.asset_id for r in db.query(ExternalAssetRepo)
+                 .filter(ExternalAssetRepo.repository_id == repo_row.id).all()]
+    out = []
+    for aid in asset_ids:
+        scan = (db.query(ExternalDastScan)
+                .filter(ExternalDastScan.asset_id == aid,
+                        ExternalDastScan.status == "done")
+                .order_by(ExternalDastScan.id.desc()).first())
+        if scan is None:
+            continue
+        asset = db.get(ExternalAsset, aid)
+        found = external_decisions.apply(findings_of(scan),
+                                         external_decisions.for_asset(db, aid),
+                                         scan_id=scan.id)
+        for f in found:
+            if vid not in str(f.get("ai_sast") or ""):
+                continue
+            if f.get("ai_verdict") == "likely_false_positive":
+                continue
+            if (f.get("decision") or {}).get("kind") == "false_positive":
+                continue
+            lk = int(f.get("likelihood") or 0)
+            out.append({
+                "host": asset.host if asset else "",
+                "asset_id": aid, "scan_id": scan.id,
+                "title": f.get("title") or "", "severity": f.get("severity") or "",
+                "likelihood": lk,
+                "likelihood_label": dast_risk.LIKELIHOOD_LABEL.get(lk, ""),
+                "verdict": f.get("ai_verdict") or "", "url": f.get("url") or "",
+                "when": scan.scanned_at or scan.started_at})
+    return out
+
+
 def restore_removed(db, scan: ExternalDastScan, key: str, actor: str) -> dict:
     """Put a finding the model took out back on the scan.  -> the finding,
     or {} when it was not taken out."""
 
@@ -1898,8 +1898,11 @@ def finding_detail(finding_id: int, request: Request, msg: str = "",
             exclusions_here = [r for r in exclusions_store.covering(db, row)
                                if r.id in mine]
 
+        from app.core import external as external_mod
+
         context = _shared(db, user)
         context.update(active_page="findings", f=row, waiver=waiver,
+                       dast_confirmed=external_mod.dast_confirmations_for(db, row),
                        exclusions_here=exclusions_here,
                        can_revoke=rbac.can(user, "waiver.revoke"),
                        host_name=host_name,
 
@@ -294,6 +294,24 @@ <h1><span class="badge {{ f.severity.value }}"
   </div>
 </div>
 
+{% if dast_confirmed %}
+<div class="notice bad" id="dast-confirmed">
+  <div><strong>Confirmed live by dynamic testing.</strong>
+    A dynamic scan reached this exact weakness on a running site, so it is not only in the code, it is exploitable now.
+    {% for d in dast_confirmed %}
+    <div class="small" style="margin-top:.3rem">
+      <span class="badge {{ d.severity }}">{{ d.severity }}</span>
+      on <a href="{{ base }}/external/{{ d.asset_id }}/scans/{{ d.scan_id }}">{{ d.host }}</a>
+      {%- if d.title %} &mdash; {{ d.title }}{% endif %}
+      {%- if d.likelihood_label %} <span class="faint">({{ d.likelihood_label }})</span>{% endif %}
+      {%- if d.when %} <span class="faint">on {{ d.when | dt('%Y-%m-%d') }}</span>{% endif %}
+    </div>
+    {% endfor %}
+    <div class="small faint" style="margin-top:.3rem">Weigh this before writing an exception: a waiver here accepts a risk a scanner has already proven is reachable, not a theoretical one.</div>
+  </div>
+</div>
+{% endif %}
+
 {% if report_fp %}
 <div class="notice warn">
   {% set others = report_fp.awaiting | length - 1 %}
@@ -1326,6 +1344,14 @@ <h1><span class="badge {{ f.severity.value }}"
         <button type="button" class="modal-close" data-close-modal>&times;</button></div>
       <div class="modal-body">
         <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+        {% if dast_confirmed %}
+        <div class="notice bad" style="margin-bottom:.6rem">
+          <strong>A dynamic scan confirmed this is live.</strong>
+          It was reached on {{ dast_confirmed[0].host }}{% if dast_confirmed | length > 1 %} and {{ dast_confirmed | length - 1 }} other site{{ '' if dast_confirmed | length - 1 == 1 else 's' }}{% endif %}.
+          Waiving it accepts a proven, exploitable risk, not a theoretical one.
+          {%- if f.kind.value != 'credential' %}  "Not in scope: this code does not get deployed" does not apply here, because the scan reached it on a running site.{% endif %}
+        </div>
+        {% endif %}
         {% if f.kind.value != 'credential' %}
         {# Not offered on a credential.  A key works whether or not the code
            it sits in is ever deployed. #}