  Software development needs continuous quality control for a timely detection
and removal of quality problems. This includes frequent quality assessments,
which need to be automated as far as possible to be feasible. One way of
automation in assessing the security of software are application scanners that
test an executing software for vulnerabilities. At present, common quality
assessments do not integrate such scanners for giving an overall quality
statement. This paper presents an integration of application scanners into a
general quality assessment method based on explicit quality models and Bayesian
nets. Its applicability and the detection capabilities of common scanners are
investigated in a case study with two open-source web shops.
