diff --git a/Lombiq.Tests.UI.Samples/Tests/CustomZapAutomationFrameworkPlan.yml b/Lombiq.Tests.UI.Samples/Tests/CustomZapAutomationFrameworkPlan.yml
index ba2162096..d76b13c02 100644
--- a/Lombiq.Tests.UI.Samples/Tests/CustomZapAutomationFrameworkPlan.yml
+++ b/Lombiq.Tests.UI.Samples/Tests/CustomZapAutomationFrameworkPlan.yml
@@ -42,21 +42,11 @@ jobs:
     enableTags: false
     disableAllRules: false
   rules:
-  - id: 10035
-    name: "Strict-Transport-Security Header"
-    threshold: "off"
-  - id: 10038
-    name: "Content Security Policy (CSP) Header Not Set"
-    threshold: "off"
-  - id: 10020
-    name: "Anti-clickjacking Header"
-    threshold: "off"
-  - id: 10037
-    name: "Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)"
-    threshold: "off"
-  - id: 10021
-    name: "X-Content-Type-Options Header Missing"
-    threshold: "off"
+    # This is required for <script> blocks which OC uses extensively. The rule may be removed when OC starts to provide
+    # cryptographic nonce for these script blocks (see https://github.com/OrchardCMS/OrchardCore/issues/13389).
+    - id: 10055
+      name: "script-src includes unsafe-inline"
+      threshold: "off"
   name: "passiveScan-config"
   type: "passiveScan-config"
 - parameters: {}
diff --git a/Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs b/Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs
index 14dbbf4e4..1530fed29 100644
--- a/Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs
+++ b/Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs
@@ -18,6 +18,12 @@ namespace Lombiq.Tests.UI.Samples.Tests;
 // sure to also check out the corresponding documentation page:
 // https://github.com/Lombiq/UI-Testing-Toolbox/blob/dev/Lombiq.Tests.UI/Docs/SecurityScanning.md.
 
+// Most common alerts can be resolved by using the OrchardCoreBuilder.ConfigureSecurityDefaultsWithStaticFiles()
+// extension method from Lombiq.HelpfulLibraries.OrchardCore. It's worth enabling in in your Program and then verifying
+// that everything still works on the site before really getting into security scanning. If you experience any problems
+// related to Content-Security-Policy, take a look at the documentation of IContentSecurityPolicyProvider and
+// ContentSecurityPolicyAttribute to adjust the permissions, because these defaults are rather strict out of the box.
+
 // Note that security scanning has cross-platform support, but due to the limitations of virtualization under Windows in
 // GitHub Actions, these tests won't work there. They'll work on a Windows desktop though.
 public class SecurityScanningTests : UITestBase
@@ -31,33 +37,38 @@ public SecurityScanningTests(ITestOutputHelper testOutputHelper)
 
     // We're running one of ZAP's built-in scans, the Baseline scan. This, as the name suggests, provides some
     // rudimentary security checks. While you can start with this, we recommend running the Full Scan, for which there
-    // similarly is an extension method as well.
+    // similarly is an extension method as well. This can take a very long time. If you want to have a broader scan in
+    // your CI test runs, use the RunAndConfigureAndAssertFullSecurityScanForContinuousIntegrationAsync extension method
+    // instead. It applies some limitations to the full scan, including time limits to the active scan portion that
+    // normally takes the longest.
 
     // If you're new to security scanning, starting with exactly this is probably a good idea. Most possibly your app
     // will fail the scan, but don't worry! You'll get a nice report about the findings in the failure dump.
     [Fact]
     public Task BasicSecurityScanShouldPass() =>
-        ExecuteTestAfterSetupAsync(context => context.RunAndAssertBaselineSecurityScanAsync());
+        ExecuteTestAfterSetupAsync(
+            context => context.RunAndAssertBaselineSecurityScanAsync(),
+            // You should configure the assertion that checks the app logs to accept some common cases that only should
+            // appear during security scanning. If you launch a full scan, this is automatically configured by the
+            // RunAndConfigureAndAssertFullSecurityScanForContinuousIntegrationAsync extension method.
+            changeConfiguration: configuration => configuration.UseAssertAppLogsForSecurityScan());
 
     // Time for some custom configuration! While this scan also runs the Baseline scan, it does this with several
     // adjustments:
-    // - Also runs ZAP's Ajax Spider (https://www.zaproxy.org/docs/desktop/addons/ajax-spider/automation/). This is
-    //   usually not just unnecessary for a website that's not an SPA, but also slows the scan down by a lot. However,
-    //   if you have an SPA, you need to use it.
-    // - Excludes certain URLs from the scan completely. Use this if you don't want ZAP to process certain URLs at all.
-    // - Disables the "Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)" alert of ZAP's passive
-    //   scan for the whole scan. This is because by default, Orchard Core sends an "X-Powered-By: OrchardCore" header.
-    //   If you want airtight security, you might want to turn this off, but for the sake of example we just ignore the
-    //   alert here.
-    // - Also disables the "Content Security Policy (CSP) Header Not Set" rule but only for the /about page. Use this to
-    //   disable rules more specifically instead of the whole scan.
-    // - Configures sign in with a user account. This is what the scan will start with. With the Blog recipe it doesn't
-    //   matter too much, since nothing on the frontend will change, but you can use this to scan authenticated features
-    //   too. Note that since ZAP uses its own spider, not the browser accessed by the test, user sessions are not
-    //   shared, so such an explicit sign in is necessary.
+    // - Also runs ZAP's Ajax Spider (https://www.zaproxy.org/docs/desktop/addons/ajax-spider/automation/). Usually this
+    //   is only necessary for sites that are single page applications (SPA).
+    // - Excludes certain URLs from the scan completely. Use this if you don't want ZAP to process those pages at all.
+    // - Disables one of ZAP's passive scan rules for the whole scan.
+    // - Also disables a rule but only for the /about page. Use this to disable rules more specifically instead of the
+    //   whole scan.
+    // - Configures sign in with a user account. This is what the scan will start with. This doesn't matter much with
+    //   the Blog recipe, because nothing on the frontend will change. You can use this to scan authenticated features
+    //   too. This is necessary because ZAP uses its own spider so it doesn't share session or cookies with the browser.
     // - The assertion on the scan results is custom. Use this if you (conditionally) want to assert on the results
     //   differently from the global context.Configuration.SecurityScanningConfiguration.AssertSecurityScanResult. The
     //   default there is "no scanning alert is allowed"; we expect some alerts here.
+    // - The suppressions are not actually necessary here. The BasicSecurityScanShouldPass works fine without them. They
+    //   are only present to illustrate the type of adjustments you may want for your own site.
     [Fact]
     public Task SecurityScanWithCustomConfigurationShouldPass() =>
         ExecuteTestAfterSetupAsync(
@@ -65,10 +76,11 @@ public Task SecurityScanWithCustomConfigurationShouldPass() =>
                 configuration => configuration
                     ////.UseAjaxSpider() // This is quite slow so just showing you here but not running it.
                     .ExcludeUrlWithRegex(".*blog.*")
-                    .DisablePassiveScanRule(10037, "Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)")
+                    .DisablePassiveScanRule(10020, "The response does not include either Content-Security-Policy with 'frame-ancestors' directive.")
                     .DisableScanRuleForUrlWithRegex(".*/about", 10038, "Content Security Policy (CSP) Header Not Set")
                     .SignIn(),
-                sarifLog => sarifLog.Runs[0].Results.Count.ShouldBeLessThan(34)));
+                sarifLog => sarifLog.Runs[0].Results.Count.ShouldBeInRange(17, 22)),
+            changeConfiguration: configuration => configuration.UseAssertAppLogsForSecurityScan());
 
     // Let's get low-level into ZAP's configuration now. While the .NET configuration API of the Lombiq UI Testing
     // Toolbox covers the most important ways to configure ZAP, sometimes you need more. For this, you have complete
@@ -110,7 +122,8 @@ public Task SecurityScanWithCustomAutomationFrameworkPlanShouldPass() =>
                         // more pages to be scanned.
                         spiderParameters.Add("maxDepth", "8");
                     }),
-                sarifLog => SecurityScanningConfiguration.AssertSecurityScanHasNoAlerts(context, sarifLog)));
+                sarifLog => SecurityScanningConfiguration.AssertSecurityScanHasNoAlerts(context, sarifLog)),
+            changeConfiguration: configuration => configuration.UseAssertAppLogsForSecurityScan());
 
     // Overriding the default setup so we can have a simpler site, simplifying the security scan for the purpose of this
     // demo. For a real app's security scan you needn't (shouldn't) do this though; always run the scan on the actual
@@ -141,13 +154,6 @@ protected override Task ExecuteTestAfterSetupAsync(
             {
                 configuration.HtmlValidationConfiguration.RunHtmlValidationAssertionOnAllPageChanges = false;
 
-                // Note how we specify an assertion too. This is because ZAP actually notices a few security issues with
-                // vanilla Orchard Core. These, however, are more like artifacts of running the app locally and out of
-                // the box without any real configuration. So, to make the tests pass, we need to override the default
-                // assertion that would fail the test if any issue is found.
-
-                // Don't do this at home! Fix the issues instead. This is only here to have a smoother demo.
-                configuration.SecurityScanningConfiguration.AssertSecurityScanResult = (_, _) => { };
                 // Check out the rest of SecurityScanningConfiguration too!
 
                 await changeConfigurationAsync(configuration);
diff --git a/Lombiq.Tests.UI.Shortcuts/Controllers/AccountController.cs b/Lombiq.Tests.UI.Shortcuts/Controllers/AccountController.cs
index 03c1632dd..e47b31eca 100644
--- a/Lombiq.Tests.UI.Shortcuts/Controllers/AccountController.cs
+++ b/Lombiq.Tests.UI.Shortcuts/Controllers/AccountController.cs
@@ -22,9 +22,8 @@ public AccountController(UserManager<IUser> userManager, SignInManager<IUser> us
     [AllowAnonymous]
     public async Task<IActionResult> SignInDirectly(string userName)
     {
-        var user = await _userManager.FindByNameAsync(userName);
-
-        if (user == null) return NotFound();
+        if (string.IsNullOrWhiteSpace(userName)) userName = "admin";
+        if (await _userManager.FindByNameAsync(userName) is not { } user) return NotFound();
 
         await _userSignInManager.SignInAsync(user, isPersistent: false);
 
diff --git a/Lombiq.Tests.UI.Shortcuts/Controllers/ErrorController.cs b/Lombiq.Tests.UI.Shortcuts/Controllers/ErrorController.cs
index 3c524852e..3f9728bcc 100644
--- a/Lombiq.Tests.UI.Shortcuts/Controllers/ErrorController.cs
+++ b/Lombiq.Tests.UI.Shortcuts/Controllers/ErrorController.cs
@@ -9,7 +9,7 @@ namespace Lombiq.Tests.UI.Shortcuts.Controllers;
 [DevelopmentAndLocalhostOnly]
 public class ErrorController : Controller
 {
-    public const string ExceptionMessage = "This action causes an exception!";
+    public const string ExceptionMessage = "This action intentionally causes an exception!";
 
     // This only happens in the CI for some reason.
     [SuppressMessage("Usage", "CA1822:Mark members as static", Justification = "It's a controller action.")]
diff --git a/Lombiq.Tests.UI.Shortcuts/Lombiq.Tests.UI.Shortcuts.csproj b/Lombiq.Tests.UI.Shortcuts/Lombiq.Tests.UI.Shortcuts.csproj
index cc4504bda..d077d6b04 100644
--- a/Lombiq.Tests.UI.Shortcuts/Lombiq.Tests.UI.Shortcuts.csproj
+++ b/Lombiq.Tests.UI.Shortcuts/Lombiq.Tests.UI.Shortcuts.csproj
@@ -50,7 +50,7 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(NuGetBuild)' == 'true'">
-    <PackageReference Include="Lombiq.HelpfulLibraries.OrchardCore" Version="8.1.0" />
+    <PackageReference Include="Lombiq.HelpfulLibraries.OrchardCore" Version="8.1.1-alpha.5.tdeal-16" />
   </ItemGroup>
 
 </Project>
diff --git a/Lombiq.Tests.UI/Docs/SecurityScanning.md b/Lombiq.Tests.UI/Docs/SecurityScanning.md
index 8ea980434..8cf077367 100644
--- a/Lombiq.Tests.UI/Docs/SecurityScanning.md
+++ b/Lombiq.Tests.UI/Docs/SecurityScanning.md
@@ -19,8 +19,28 @@ You can create detailed security scans of your app with [Zed Attack Proxy (ZAP)]
 - While ZAP is fully managed for you, Docker needs to be available and running to host the ZAP instance. On your development machine, you can install [Docker Desktop](https://www.docker.com/products/docker-desktop/).
 - The full scan of a website with even just 1-200 pages can take 5-10 minutes. So, be careful to fine-tune the ZAP configuration to make it suitable for your app.
 
+## Limitations
+
+On Windows-based GitHub runners the security tests always fail with the following error:
+
+> The `docker.exe pull softwaresecurityproject/zap-stable:2.14.0 --quiet` command failed with the output below.
+> no matching manifest for windows/amd64 10.0.20348 in the manifest list entries.
+
+This is because the Docker installation is configured to use Windows images, while the [ZAP docker image](https://hub.docker.com/r/softwaresecurityproject/zap-stable/tags) is only available for Linux. If you rely on our [Lombiq GitHub Actions](https://github.com/Lombiq/GitHub-Actions) then you can configure it like this to disable a test, in this case `SecurityScanningTests`:
+
+```yaml
+  build-and-test:
+    name: Build and Test
+    # See https://github.com/Lombiq/GitHub-Actions/blob/dev/.github/workflows/build-and-test-orchard-core.yml.
+    uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
+    with:
+      machine-types: '["windows-latest"]'
+      test-filter: "FullyQualifiedName!~SecurityScanningTests"
+```
+
 ## Troubleshooting
 
+- Most common alerts in Orchard Core can be resolved by [using the extension method in Lombiq Helpful Libraries](https://github.com/Lombiq/Helpful-Libraries/blob/dev/Lombiq.HelpfulLibraries.OrchardCore/Docs/Security.md) like this: `orchardCoreBuilder.ConfigureSecurityDefaults(allowInlineStyle: true)`.
 - If you're unsure what happens in a scan, run the [ZAP desktop app](https://www.zaproxy.org/download/) and load the Automation Framework plan's YAML file into it. If you use the default scans, then these will be available under the build output directory (like _bin/Debug_) under _SecurityScanning/AutomationFrameworkPlans_. Then, you can open and run them as demonstrated [in this video](https://youtu.be/PnCbIAnauD8?si=u0vi63Uvv9wZINzb&t=1173).
 - If an alert is a false positive, follow [the official docs](https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/). You can use the [`alertFilter` job](https://www.zaproxy.org/docs/desktop/addons/alert-filters/automation/) to ignore alerts in very specific conditions. You can also access this via the .NET configuration API.
 - ZAP didn't find everything in your app? By default, ZAP has a crawl depth of 5 for its standard spider and 10 for its AJAX spider. Set `maxDepth` (and `maxChildren`) [for `spider`](https://www.zaproxy.org/docs/desktop/addons/automation-framework/job-spider/) and `maxCrawlDepth` [for `spiderAjax`](https://www.zaproxy.org/docs/desktop/addons/ajax-spider/automation/).
diff --git a/Lombiq.Tests.UI/Extensions/BrowserUITestContextExtensions.cs b/Lombiq.Tests.UI/Extensions/BrowserUITestContextExtensions.cs
index 6e4695686..9e43cec34 100644
--- a/Lombiq.Tests.UI/Extensions/BrowserUITestContextExtensions.cs
+++ b/Lombiq.Tests.UI/Extensions/BrowserUITestContextExtensions.cs
@@ -62,4 +62,35 @@ public static async Task<T> FetchWithBrowserContextAsync<T>(
 
         return await processResponseAsync(response);
     }
+
+    /// <summary>
+    /// Performs a <paramref name="task"/> with app log assertion temporarily disabled. But first <see
+    /// cref="OrchardCoreUITestExecutorConfiguration.AssertAppLogsAsync"/> is used to ensure no unrelated errors are
+    /// masked by this activity. Afterwards it's used again to verify the results, and if it fails then the logs are
+    /// cleared out.
+    /// </summary>
+    /// <returns>A task indicating whether there were anything in the app logs that failed the assertion.</returns>
+    public static async Task<bool> DoWithoutAppLogAssertionAsync(this UITestContext context, Func<Task> task)
+    {
+        // Verify that the app logs are fine right now, then suppress logs for the duration of the task.
+        await context.Configuration.AssertAppLogsAsync(context.Application);
+        var assertAppLogsAsync = context.Configuration.AssertAppLogsAsync;
+        context.Configuration.AssertAppLogsAsync = _ => Task.CompletedTask;
+
+        await task();
+
+        // Restore the app log assertion and determine if it failed. Clear the logs if failure occurred.
+        context.Configuration.AssertAppLogsAsync = assertAppLogsAsync;
+        try
+        {
+            await context.Configuration.AssertAppLogsAsync(context.Application);
+        }
+        catch
+        {
+            context.ClearLogs();
+            return true;
+        }
+
+        return false;
+    }
 }
diff --git a/Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs b/Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs
index 3b6162b11..e0b161f38 100644
--- a/Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs
+++ b/Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs
@@ -1,4 +1,8 @@
+using System;
+using System.Collections.Generic;
 using System.Diagnostics.CodeAnalysis;
+using System.Linq;
+using System.Text.Json;
 
 namespace Shouldly;
 
@@ -17,4 +21,41 @@ public static void ShouldBeAsString(this object actual, object expected, string
 
         actualText.ShouldBe(expected?.ToString(), customMessage);
     }
+
+    /// <summary>
+    /// Filters the provided <paramref name="enumerable"/> by the <paramref name="condition"/>. If the result is not
+    /// empty, a <see cref="ShouldAssertException"/> is thrown. A JSON serialized string of the results is provided as
+    /// the custom message of the exception.
+    /// </summary>
+    /// <remarks><para>
+    /// This extension method is similar to <c>enumerable.ShouldNotContain(condition)</c>, but it offers much better
+    /// developer experience because all the offending items are listed right there in the exception message. The
+    /// overhead is minimal during non-exceptional operation (only the creation of an empty list), and it's well worth
+    /// the added clarity during failure.
+    /// </para></remarks>
+    public static void ShouldBeEmptyWhen<TItem>(
+        this IEnumerable<TItem> enumerable,
+        Func<TItem, bool> condition,
+        JsonSerializerOptions jsonSerializerOptions = null) =>
+        enumerable.ShouldBeEmptyWhen<TItem, TItem>(condition, messageTransform: null, jsonSerializerOptions);
+
+    /// <inheritdoc cref="ShouldBeEmptyWhen{TItem}"/>
+    /// <param name="messageTransform">
+    /// When not <see langword="null"/>, the results are transformed with this method before they
+    /// are serialized into JSON.
+    /// </param>
+    public static void ShouldBeEmptyWhen<TItem, TMessage>(
+        this IEnumerable<TItem> enumerable,
+        Func<TItem, bool> condition,
+        Func<TItem, TMessage> messageTransform,
+        JsonSerializerOptions jsonSerializerOptions = null)
+    {
+        var results = enumerable.Where(condition).ToList();
+        if (!results.Any()) return;
+
+        var message = messageTransform == null
+            ? JsonSerializer.Serialize(results, jsonSerializerOptions)
+            : JsonSerializer.Serialize(results.Select(messageTransform), jsonSerializerOptions);
+        results.ShouldBeEmpty(message); // This will always throw at this point.
+    }
 }
diff --git a/Lombiq.Tests.UI/Extensions/TypedRouteUITestContextExtensions.cs b/Lombiq.Tests.UI/Extensions/TypedRouteUITestContextExtensions.cs
index cd2033e44..f3a2535c1 100644
--- a/Lombiq.Tests.UI/Extensions/TypedRouteUITestContextExtensions.cs
+++ b/Lombiq.Tests.UI/Extensions/TypedRouteUITestContextExtensions.cs
@@ -62,6 +62,28 @@ public static string GetRelativeUrlOfAction<TController>(
             .CreateFromExpression(actionExpressionAsync.StripResult(), additionalArguments, CreateServiceProvider(context))
             .ToString();
 
+    /// <summary>
+    /// Gets the absolute URL generated by <see cref="TypedRoute"/> for the <paramref name="actionExpression"/> in the
+    /// <typeparamref name="TController"/>.
+    /// </summary>
+    public static Uri GetAbsoluteUrlOfAction<TController>(
+        this UITestContext context,
+        Expression<Action<TController>> actionExpression,
+        params (string Key, object Value)[] additionalArguments)
+        where TController : ControllerBase =>
+        context.GetAbsoluteUri(context.GetRelativeUrlOfAction(actionExpression, additionalArguments));
+
+    /// <summary>
+    /// Gets the absolute URL generated by <see cref="TypedRoute"/> for the <paramref name="actionExpressionAsync"/> in
+    /// the <typeparamref name="TController"/>.
+    /// </summary>
+    public static Uri GetAbsoluteUrlOfAction<TController>(
+        this UITestContext context,
+        Expression<Func<TController, Task>> actionExpressionAsync,
+        params (string Key, object Value)[] additionalArguments)
+        where TController : ControllerBase =>
+        context.GetAbsoluteUri(context.GetRelativeUrlOfAction(actionExpressionAsync, additionalArguments));
+
     private static IServiceProvider CreateServiceProvider(UITestContext context)
     {
         var services = new ServiceCollection();
diff --git a/Lombiq.Tests.UI/Extensions/WebApplicationInstanceExtensions.cs b/Lombiq.Tests.UI/Extensions/WebApplicationInstanceExtensions.cs
index 0815a9f19..073beb887 100644
--- a/Lombiq.Tests.UI/Extensions/WebApplicationInstanceExtensions.cs
+++ b/Lombiq.Tests.UI/Extensions/WebApplicationInstanceExtensions.cs
@@ -1,6 +1,8 @@
 using Lombiq.Tests.UI.Services;
 using Shouldly;
 using System;
+using System.Collections.Generic;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -12,19 +14,35 @@ public static class WebApplicationInstanceExtensions
     /// Asserting that the logs should be empty. When they aren't the Shouldly exception will contain the logs'
     /// contents.
     /// </summary>
+    /// <param name="permittedErrorLines">
+    /// If not <see langword="null"/> or empty, each line is split and any lines containing <c>|ERROR|</c> will be
+    /// ignored if they contain any string from this collection (case-insensitive).
+    /// </param>
     public static async Task LogsShouldBeEmptyAsync(
         this IWebApplicationInstance webApplicationInstance,
         bool canContainWarnings = false,
+        ICollection<string> permittedErrorLines = null,
         CancellationToken cancellationToken = default)
     {
         if (cancellationToken == default) cancellationToken = CancellationToken.None;
+        permittedErrorLines ??= Array.Empty<string>();
 
         var logOutput = await webApplicationInstance.GetLogOutputAsync(cancellationToken);
 
         if (canContainWarnings)
         {
-            logOutput.ShouldNotContain("|ERROR|");
             logOutput.ShouldNotContain("|FATAL|");
+
+            var errorLines = logOutput
+                .SplitByNewLines()
+                .Where(line => line.Contains("|ERROR|"));
+
+            if (permittedErrorLines.Any())
+            {
+                errorLines = errorLines.Where(line => !permittedErrorLines.Any(line.ContainsOrdinalIgnoreCase));
+            }
+
+            errorLines.ShouldBeEmpty();
         }
         else
         {
diff --git a/Lombiq.Tests.UI/Helpers/DirectoryHelper.cs b/Lombiq.Tests.UI/Helpers/DirectoryHelper.cs
index 8af0780d7..a9bd29db8 100644
--- a/Lombiq.Tests.UI/Helpers/DirectoryHelper.cs
+++ b/Lombiq.Tests.UI/Helpers/DirectoryHelper.cs
@@ -41,4 +41,25 @@ public static void SafelyDeleteDirectoryIfExists(string path, int maxTryCount =
             }
         }
     }
+
+    /// <summary>
+    /// Creates a directory with the given path and a numeric suffix from 1 to <see cref="int.MaxValue"/>. This means if
+    /// the <paramref name="path"/> is <c>c:\MyDirectory</c> then it will first attempt to create <c>c:\MyDirectory1</c>
+    /// but if that already exists it will try to create <c>c:\MyDirectory2</c> instead, and so on.
+    /// </summary>
+    /// <param name="path">The base path to use when constructing the final path.</param>
+    /// <returns>The final path created.</returns>
+    public static string CreateEnumeratedDirectory(string path)
+    {
+        for (var i = 1; i < int.MaxValue; i++)
+        {
+            var newPath = path + i.ToTechnicalString();
+            if (Directory.Exists(newPath)) continue;
+
+            Directory.CreateDirectory(newPath);
+            return newPath;
+        }
+
+        throw new InvalidOperationException("Couldn't create a new directory within the integer space.");
+    }
 }
diff --git a/Lombiq.Tests.UI/Lombiq.Tests.UI.csproj b/Lombiq.Tests.UI/Lombiq.Tests.UI.csproj
index 28dae6c07..ff194d3d3 100644
--- a/Lombiq.Tests.UI/Lombiq.Tests.UI.csproj
+++ b/Lombiq.Tests.UI/Lombiq.Tests.UI.csproj
@@ -103,9 +103,9 @@
 
   <ItemGroup Condition="'$(NuGetBuild)' == 'true'">
     <PackageReference Include="Lombiq.Tests" Version="2.2.5" />
-    <PackageReference Include="Lombiq.HelpfulLibraries.Cli" Version="8.1.0" />
-    <PackageReference Include="Lombiq.HelpfulLibraries.OrchardCore" Version="8.1.0" />
-    <PackageReference Include="Lombiq.HelpfulLibraries.Refit" Version="8.1.0" />
+    <PackageReference Include="Lombiq.HelpfulLibraries.Cli" Version="8.1.1-alpha.5.tdeal-16" />
+    <PackageReference Include="Lombiq.HelpfulLibraries.OrchardCore" Version="8.1.1-alpha.5.tdeal-16" />
+    <PackageReference Include="Lombiq.HelpfulLibraries.Refit" Version="8.1.1-alpha.5.tdeal-16" />
     <PackageReference Include="Lombiq.Npm.Targets" Version="1.4.0" />
   </ItemGroup>
 
diff --git a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml
index 3ebde1b96..88ec3a373 100644
--- a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml
+++ b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml
@@ -42,9 +42,24 @@ jobs:
     enableTags: false
     disableAllRules: false
   rules:
+  # This needs to be disabled during UI testing, because a local app needn't use HSTS. It's also something commonly
+  # configured outside the app, like in Cloudflare.
   - id: 10035
     name: "Strict-Transport-Security Header"
     threshold: "off"
+  # This is required for <script> blocks which OC uses extensively. The rule may be removed when OC starts to provide
+  # cryptographic nonce for these script blocks (see https://github.com/OrchardCMS/OrchardCore/issues/13389).
+  - id: 10055
+    name: "script-src includes unsafe-inline"
+    threshold: "off"
+  # This is a low-risk alert, enforcing it is undesirable for branding.
+  - id: 10037
+    name: "Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)"
+    threshold: "off"
+  # This rule generates false positives on UUIDs or random numeric sequences, see https://github.com/zaproxy/zaproxy/issues/8303.
+  - id: 10062
+    name: "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data."
+    threshold: "high"
   name: "passiveScan-config"
   type: "passiveScan-config"
 - parameters: {}
diff --git a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/FullScan.yml b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/FullScan.yml
index 19bf336b2..87afb8828 100644
--- a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/FullScan.yml
+++ b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/FullScan.yml
@@ -42,9 +42,24 @@ jobs:
     enableTags: false
     disableAllRules: false
   rules:
+  # This needs to be disabled during UI testing, because a local app needn't use HSTS. It's also something commonly
+  # configured outside the app, like in Cloudflare.
   - id: 10035
     name: "Strict-Transport-Security Header"
     threshold: "off"
+  # This is required for <script> blocks which OC uses extensively. The rule may be removed when OC starts to provide
+  # cryptographic nonce for these script blocks (see https://github.com/OrchardCMS/OrchardCore/issues/13389).
+  - id: 10055
+    name: "script-src includes unsafe-inline"
+    threshold: "off"
+  # This is a low-risk alert, enforcing it is undesirable for branding.
+  - id: 10037
+    name: "Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)"
+    threshold: "off"
+  # This rule generates false positives on UUIDs or random numeric sequences, see https://github.com/zaproxy/zaproxy/issues/8303.
+  - id: 10062
+    name: "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data."
+    threshold: "high"
   name: "passiveScan-config"
   type: "passiveScan-config"
 - parameters: {}
diff --git a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/GraphQL.yml b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/GraphQL.yml
index 24f14d902..3be077479 100644
--- a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/GraphQL.yml
+++ b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/GraphQL.yml
@@ -42,9 +42,24 @@ jobs:
     enableTags: false
     disableAllRules: false
   rules:
+  # This needs to be disabled during UI testing, because a local app needn't use HSTS. It's also something commonly
+  # configured outside the app, like in Cloudflare.
   - id: 10035
     name: "Strict-Transport-Security Header"
     threshold: "off"
+  # This is required for <script> blocks which OC uses extensively. The rule may be removed when OC starts to provide
+  # cryptographic nonce for these script blocks (see https://github.com/OrchardCMS/OrchardCore/issues/13389).
+  - id: 10055
+    name: "script-src includes unsafe-inline"
+    threshold: "off"
+  # This is a low-risk alert, enforcing it is undesirable for branding.
+  - id: 10037
+    name: "Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)"
+    threshold: "off"
+  # This rule generates false positives on UUIDs or random numeric sequences, see https://github.com/zaproxy/zaproxy/issues/8303.
+  - id: 10062
+    name: "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data."
+    threshold: "high"
   name: "passiveScan-config"
   type: "passiveScan-config"
 - parameters:
diff --git a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/OpenAPI.yml b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/OpenAPI.yml
index 9327dc09a..eed3c0552 100644
--- a/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/OpenAPI.yml
+++ b/Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/OpenAPI.yml
@@ -42,9 +42,24 @@ jobs:
     enableTags: false
     disableAllRules: false
   rules:
+  # This needs to be disabled during UI testing, because a local app needn't use HSTS. It's also something commonly
+  # configured outside the app, like in Cloudflare.
   - id: 10035
     name: "Strict-Transport-Security Header"
     threshold: "off"
+  # This is required for <script> blocks which OC uses extensively. The rule may be removed when OC starts to provide
+  # cryptographic nonce for these script blocks (see https://github.com/OrchardCMS/OrchardCore/issues/13389).
+  - id: 10055
+    name: "script-src includes unsafe-inline"
+    threshold: "off"
+  # This is a low-risk alert, enforcing it is undesirable for branding.
+  - id: 10037
+    name: "Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)"
+    threshold: "off"
+  # This rule generates false positives on UUIDs or random numeric sequences, see https://github.com/zaproxy/zaproxy/issues/8303.
+  - id: 10062
+    name: "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data."
+    threshold: "high"
   name: "passiveScan-config"
   type: "passiveScan-config"
 - parameters: {}
diff --git a/Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs b/Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs
index 4aad3938e..c486a3ce3 100644
--- a/Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs
+++ b/Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs
@@ -1,11 +1,9 @@
 using Lombiq.HelpfulLibraries.OrchardCore.Mvc;
 using Lombiq.Tests.UI.Constants;
-using Lombiq.Tests.UI.Extensions;
 using Lombiq.Tests.UI.Services;
 using Lombiq.Tests.UI.Shortcuts.Controllers;
 using System;
 using System.Collections.Generic;
-using System.Linq;
 using System.Threading.Tasks;
 using YamlDotNet.RepresentationModel;
 
@@ -23,17 +21,25 @@ namespace Lombiq.Tests.UI.SecurityScanning;
 /// </remarks>
 public class SecurityScanConfiguration
 {
+    private readonly List<Uri> _additionalUris = new();
+    private readonly List<string> _excludedUrlRegexPatterns = new();
+    private readonly List<ScanRule> _disabledActiveScanRules = new();
+    private readonly Dictionary<ScanRule, (ScanRuleThreshold Threshold, ScanRuleStrength Strength)> _configuredActiveScanRules = new();
+    private readonly List<ScanRule> _disabledPassiveScanRules = new();
+    private readonly List<(string Url, int Id, string RuleName)> _disabledRulesForUrls = new();
+    private readonly List<(string Url, int Id, string RuleName, string Justification)> _falsePositives = new();
+    private readonly List<Func<YamlDocument, Task>> _zapPlanModifiers = new();
+
     public Uri StartUri { get; private set; }
-    public IList<Uri> AdditionalUris { get; } = new List<Uri>();
     public bool AjaxSpiderIsUsed { get; private set; }
     public string SignInUserName { get; private set; }
-    public IList<string> ExcludedUrlRegexPatterns { get; } = new List<string>();
-    public IList<ScanRule> DisabledActiveScanRules { get; } = new List<ScanRule>();
-    public IDictionary<ScanRule, (ScanRuleThreshold Threshold, ScanRuleStrength Strength)> ConfiguredActiveScanRules { get; } =
-        new Dictionary<ScanRule, (ScanRuleThreshold, ScanRuleStrength)>();
-    public IList<ScanRule> DisabledPassiveScanRules { get; } = new List<ScanRule>();
-    public IDictionary<string, ScanRule> DisabledRulesForUrls { get; } = new Dictionary<string, ScanRule>();
-    public IList<Func<YamlDocument, Task>> ZapPlanModifiers { get; } = new List<Func<YamlDocument, Task>>();
+
+    /// <summary>
+    /// Gets a value indicating whether the security scan should not visit the <see cref="ErrorController"/> to test
+    /// for correct error handling. This is achieved by adding the error page URL to the configuration with <see
+    /// cref="YamlDocumentExtensions.AddRequestor"/>.
+    /// </summary>
+    public bool DontScanErrorPage { get; private set; }
 
     internal SecurityScanConfiguration()
     {
@@ -56,7 +62,7 @@ public SecurityScanConfiguration StartAtUri(Uri startUri)
     /// <param name="additionalUri">The <see cref="Uri"/> under the app to also cover during the scan.</param>
     public SecurityScanConfiguration AddAdditionalUri(Uri additionalUri)
     {
-        AdditionalUris.Add(additionalUri);
+        _additionalUris.Add(additionalUri);
         return this;
     }
 
@@ -90,7 +96,7 @@ public SecurityScanConfiguration SignIn(string userName = DefaultUser.UserName)
     /// </param>
     public SecurityScanConfiguration ExcludeUrlWithRegex(string excludedUrlRegex)
     {
-        ExcludedUrlRegexPatterns.Add(excludedUrlRegex);
+        _excludedUrlRegexPatterns.Add(excludedUrlRegex);
         return this;
     }
 
@@ -105,7 +111,7 @@ public SecurityScanConfiguration ExcludeUrlWithRegex(string excludedUrlRegex)
     /// </param>
     public SecurityScanConfiguration DisableActiveScanRule(int id, string name = "")
     {
-        DisabledActiveScanRules.Add(new ScanRule(id, name));
+        _disabledActiveScanRules.Add(new ScanRule(id, name));
         return this;
     }
 
@@ -127,7 +133,7 @@ public SecurityScanConfiguration DisableActiveScanRule(int id, string name = "")
     /// </param>
     public SecurityScanConfiguration ConfigureActiveScanRule(int id, ScanRuleThreshold threshold, ScanRuleStrength strength, string name = "")
     {
-        ConfiguredActiveScanRules.Add(new ScanRule(id, name), (threshold, strength));
+        _configuredActiveScanRules.Add(new ScanRule(id, name), (threshold, strength));
         return this;
     }
 
@@ -142,7 +148,7 @@ public SecurityScanConfiguration ConfigureActiveScanRule(int id, ScanRuleThresho
     /// </param>
     public SecurityScanConfiguration DisablePassiveScanRule(int id, string name = "")
     {
-        DisabledPassiveScanRules.Add(new ScanRule(id, name));
+        _disabledPassiveScanRules.Add(new ScanRule(id, name));
         return this;
     }
 
@@ -161,7 +167,44 @@ public SecurityScanConfiguration DisablePassiveScanRule(int id, string name = ""
     /// </param>
     public SecurityScanConfiguration DisableScanRuleForUrlWithRegex(string urlRegex, int ruleId, string ruleName = "")
     {
-        DisabledRulesForUrls[urlRegex] = new ScanRule(ruleId, ruleName);
+        _disabledRulesForUrls.Add((urlRegex, ruleId, ruleName));
+        return this;
+    }
+
+    /// <summary>
+    /// Marks a rule (can be any rule, including e.g. both active or passive scan rules) as false positive for just URLs
+    /// matching the given regular expression pattern.
+    /// </summary>
+    /// <param name="urlRegex">
+    /// The regex pattern to match URLs against. It will be matched against the whole absolute URL, e.g., ".*blog.*"
+    /// will match https://example.com/blog, https://example.com/blog/my-post, etc.
+    /// </param>
+    /// <param name="ruleId">The ID of the rule. In the scan report, this is usually displayed as "Plugin Id".</param>
+    /// <param name="ruleName">
+    /// The human-readable name of the rule. Not required to turn off the rule, and its value doesn't matter. It's just
+    /// useful for the readability of the method call.
+    /// </param>
+    /// <param name="justification">
+    /// A human-readable explanation of why the alert is false positive.
+    /// </param>
+    /// <remarks><para>
+    /// Marking a rule as false positive helps the development of ZAP by collecting which rules have the highest false
+    /// positive rate (see <see href="https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/">the FAQ</see>).
+    /// </para></remarks>
+    public SecurityScanConfiguration MarkScanRuleAsFalsePositiveForUrlWithRegex(
+        string urlRegex,
+        int ruleId,
+        string ruleName,
+        string justification)
+    {
+        if (string.IsNullOrWhiteSpace(justification?.Trim()))
+        {
+            throw new InvalidOperationException(
+                "Please provide a detailed justification for marking this alert as a false positive, including " +
+                "context and reasoning.");
+        }
+
+        _falsePositives.Add((urlRegex, ruleId, ruleName, justification));
         return this;
     }
 
@@ -176,7 +219,7 @@ public SecurityScanConfiguration DisableScanRuleForUrlWithRegex(string urlRegex,
     /// </param>
     public SecurityScanConfiguration ModifyZapPlan(Func<YamlDocument, Task> modifyPlan)
     {
-        ZapPlanModifiers.Add(modifyPlan);
+        _zapPlanModifiers.Add(modifyPlan);
         return this;
     }
 
@@ -191,7 +234,7 @@ public SecurityScanConfiguration ModifyZapPlan(Func<YamlDocument, Task> modifyPl
     /// </param>
     public SecurityScanConfiguration ModifyZapPlan(Action<YamlDocument> modifyPlan)
     {
-        ZapPlanModifiers.Add(yamlDocument =>
+        _zapPlanModifiers.Add(yamlDocument =>
         {
             modifyPlan(yamlDocument);
             return Task.CompletedTask;
@@ -204,16 +247,14 @@ internal async Task ApplyToPlanAsync(YamlDocument yamlDocument, UITestContext co
     {
         yamlDocument.SetStartUrl(StartUri);
 
-        foreach (var uri in AdditionalUris) yamlDocument.AddUrl(uri);
+        foreach (var uri in _additionalUris) yamlDocument.AddUrl(uri);
 
         if (AjaxSpiderIsUsed) yamlDocument.AddSpiderAjaxAfterSpider();
 
         if (!string.IsNullOrEmpty(SignInUserName))
         {
-            yamlDocument.AddRequestor(
-                context.GetAbsoluteUri(
-                    context.GetRelativeUrlOfAction<AccountController>(controller => controller.SignInDirectly(SignInUserName)))
-                .ToString());
+            var url = context.GetAbsoluteUrlOfAction<AccountController>(controller => controller.SignInDirectly(SignInUserName));
+            yamlDocument.AddRequestor(url.AbsoluteUri);
 
             // With such direct sign in we don't need to utilize ZAP's authentication and user managements mechanisms
             // (see https://www.zaproxy.org/docs/desktop/start/features/authmethods/ and
@@ -234,10 +275,10 @@ internal async Task ApplyToPlanAsync(YamlDocument yamlDocument, UITestContext co
             //   pollPostData: ""
         }
 
-        yamlDocument.AddExcludePathsRegex(ExcludedUrlRegexPatterns.ToArray());
-        foreach (var rule in DisabledActiveScanRules) yamlDocument.DisableActiveScanRule(rule.Id, rule.Name);
+        yamlDocument.AddExcludePathsRegex(_excludedUrlRegexPatterns.ToArray());
+        foreach (var rule in _disabledActiveScanRules) yamlDocument.DisableActiveScanRule(rule.Id, rule.Name);
 
-        foreach (var ruleConfiguration in ConfiguredActiveScanRules)
+        foreach (var ruleConfiguration in _configuredActiveScanRules)
         {
             yamlDocument.ConfigureActiveScanRule(
                 ruleConfiguration.Key.Id,
@@ -246,9 +287,10 @@ internal async Task ApplyToPlanAsync(YamlDocument yamlDocument, UITestContext co
                 ruleConfiguration.Key.Name);
         }
 
-        foreach (var rule in DisabledPassiveScanRules) yamlDocument.DisablePassiveScanRule(rule.Id, rule.Name);
-        foreach (var urlToRule in DisabledRulesForUrls) yamlDocument.AddAlertFilter(urlToRule.Key, urlToRule.Value.Id, urlToRule.Value.Name);
-        foreach (var modifier in ZapPlanModifiers) await modifier(yamlDocument);
+        foreach (var rule in _disabledPassiveScanRules) yamlDocument.DisablePassiveScanRule(rule.Id, rule.Name);
+        foreach (var (url, id, name) in _disabledRulesForUrls) yamlDocument.AddDisableRuleFilter(url, id, name);
+        foreach (var (url, id, name, justification) in _falsePositives) yamlDocument.AddFalsePositiveRuleFilter(url, id, name, justification);
+        foreach (var modifier in _zapPlanModifiers) await modifier(yamlDocument);
     }
 
     public class ScanRule
diff --git a/Lombiq.Tests.UI/SecurityScanning/SecurityScanningConfiguration.cs b/Lombiq.Tests.UI/SecurityScanning/SecurityScanningConfiguration.cs
index 0bf3df4f7..bec664945 100644
--- a/Lombiq.Tests.UI/SecurityScanning/SecurityScanningConfiguration.cs
+++ b/Lombiq.Tests.UI/SecurityScanning/SecurityScanningConfiguration.cs
@@ -30,7 +30,16 @@ public class SecurityScanningConfiguration
     /// </summary>
     public Action<UITestContext, SarifLog> AssertSecurityScanResult { get; set; } = AssertSecurityScanHasNoAlerts;
 
-    public static readonly Action<UITestContext, SarifLog> AssertSecurityScanHasNoAlerts =
-        (_, sarifLog) => sarifLog.Runs[0].Results.ShouldNotContain(result =>
-            result.Kind == ResultKind.Fail && result.Level != FailureLevel.None && result.Level != FailureLevel.Note);
+    public static readonly Action<UITestContext, SarifLog> AssertSecurityScanHasNoAlerts = (_, sarifLog) =>
+        sarifLog.Runs[0].Results.ShouldBeEmptyWhen(
+            result =>
+                result.Kind == ResultKind.Fail &&
+                result.Level != FailureLevel.None &&
+                result.Level != FailureLevel.Note,
+            result => new
+            {
+                Kind = result.Kind.ToString(),
+                Level = result.Level.ToString(),
+                Details = result,
+            });
 }
diff --git a/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs b/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
index 95c5c790c..fbc7d999a 100644
--- a/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
+++ b/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
@@ -1,6 +1,8 @@
+using Lombiq.HelpfulLibraries.OrchardCore.Mvc;
 using Lombiq.Tests.UI.Exceptions;
 using Lombiq.Tests.UI.Extensions;
 using Lombiq.Tests.UI.Services;
+using Lombiq.Tests.UI.Shortcuts.Controllers;
 using Microsoft.CodeAnalysis.Sarif;
 using System;
 using System.Threading.Tasks;
@@ -47,6 +49,50 @@ public static Task RunAndAssertFullSecurityScanAsync(
             configure,
             assertSecurityScanResult);
 
+    /// <inheritdoc cref="RunAndAssertFullSecurityScanAsync"/>
+    /// <param name="doSignIn">If <see langword="true"/> the bot is configured to sign in as <c>admin</c> first.</param>
+    /// <param name="maxActiveScanDurationInMinutes">Time limit for the active scan altogether.</param>
+    /// <param name="maxRuleDurationInMinutes">Time limit for the individual rules in the active scan.</param>
+    /// <remarks><para>
+    /// This extension method makes changes to the normal configuration of the test to be more suited for CI operation.
+    /// It changes the <see cref="UITestContext.Configuration"/> to not do any retries because this is a long running
+    /// test. It also replaces the app log assertion logic with the specialized version for security scans, <see
+    /// cref="OrchardCoreUITestExecutorConfiguration.UseAssertAppLogsForSecurityScan"/>. The scan is configured t
+    /// ignore the admin dashboard, optionally log in as admin, and use the provided time limits for the "active scan"
+    /// portion of the security scan.
+    /// </para></remarks>
+    public static Task RunAndConfigureAndAssertFullSecurityScanForContinuousIntegrationAsync(
+        this UITestContext context,
+        Action<SecurityScanConfiguration> additionalConfiguration = null,
+        Action<SarifLog> assertSecurityScanResult = null,
+        bool doSignIn = true,
+        int maxActiveScanDurationInMinutes = 10,
+        int maxRuleDurationInMinutes = 2)
+    {
+        // Ignore some validation errors that only happen during security tests.
+        context.Configuration.UseAssertAppLogsForSecurityScan();
+
+        // This takes over 10 minutes and the session will certainly time out with retries.
+        context.Configuration.MaxRetryCount = 0;
+
+        return context.RunAndAssertFullSecurityScanAsync(
+            configuration =>
+            {
+                // Signing in ensures full access and that the bot won't have to interact with the login screen.
+                if (doSignIn) configuration.SignIn();
+
+                // There is no need to security scan the admin dashboard.
+                configuration.ExcludeUrlWithRegex(@".*/Admin/.*");
+
+                // Active scan takes a very long time, this is not practical in CI.
+                configuration.ModifyZapPlan(plan => plan
+                    .SetActiveScanMaxDuration(maxActiveScanDurationInMinutes, maxRuleDurationInMinutes));
+
+                additionalConfiguration?.Invoke(configuration);
+            },
+            assertSecurityScanResult);
+    }
+
     /// <summary>
     /// Run a <see href="https://www.zaproxy.org/">Zed Attack Proxy (ZAP)</see> security scan against an app with the
     /// GraphQL Automation Framework profile and runs assertions on the result (see <see
@@ -107,17 +153,30 @@ public static async Task RunAndAssertSecurityScanAsync(
         Action<SecurityScanConfiguration> configure = null,
         Action<SarifLog> assertSecurityScanResult = null)
     {
-        var configuration = context.Configuration.SecurityScanningConfiguration;
+        var configuration = context.Configuration.SecurityScanningConfiguration ?? new SecurityScanningConfiguration();
 
         SecurityScanResult result = null;
         try
         {
-            result = await context.RunSecurityScanAsync(automationFrameworkYamlPath, configure);
+            result = await context.RunSecurityScanAsync(automationFrameworkYamlPath, scanConfiguration =>
+            {
+                // Verify that error page handling also works by visiting a known error page with no logging.
+                if (!scanConfiguration.DontScanErrorPage)
+                {
+                    var errorUrl = context.GetAbsoluteUrlOfAction<ErrorController>(controller => controller.Index());
+                    scanConfiguration.ModifyZapPlan(yamlDocument => yamlDocument.AddRequestor(errorUrl.AbsoluteUri));
+                }
+
+                configure?.Invoke(scanConfiguration);
+            });
 
             if (assertSecurityScanResult != null) assertSecurityScanResult(result.SarifLog);
-            else configuration?.AssertSecurityScanResult(context, result.SarifLog);
+            else configuration.AssertSecurityScanResult(context, result.SarifLog);
 
-            if (configuration.CreateReportAlways) context.AppendDirectoryToFailureDump(result.ReportsDirectoryPath);
+            if (configuration.CreateReportAlways)
+            {
+                context.AppendDirectoryToFailureDump(result.ReportsDirectoryPath);
+            }
         }
         catch (Exception ex)
         {
@@ -143,9 +202,12 @@ public static Task<SecurityScanResult> RunSecurityScanAsync(
         string automationFrameworkYamlPath,
         Action<SecurityScanConfiguration> configure = null)
     {
-        var configuration = new SecurityScanConfiguration();
+        var configuration = new SecurityScanConfiguration()
+            .StartAtUri(context.GetCurrentUri());
 
-        configuration.StartAtUri(context.GetCurrentUri());
+        // By default ignore /vendor/ or /vendors/ URLs. This is case-insensitive. We have no control over them, and
+        // they may contain several false positives (e.g. in font-awesome).
+        configuration.ExcludeUrlWithRegex(@".*/vendors?/.*");
 
         if (context.Configuration.SecurityScanningConfiguration.ZapAutomationFrameworkPlanModifier != null)
         {
diff --git a/Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs b/Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs
index 9966e63ad..1a918091b 100644
--- a/Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs
+++ b/Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs
@@ -108,9 +108,7 @@ public static YamlDocument AddExcludePathsRegex(this YamlDocument yamlDocument,
     {
         var currentContext = yamlDocument.GetCurrentContext();
 
-        if (!currentContext.Children.ContainsKey("excludePaths")) currentContext.Add("excludePaths", new YamlSequenceNode());
-
-        var excludePaths = (YamlSequenceNode)currentContext["excludePaths"];
+        var excludePaths = currentContext.GetOrAddNode<YamlSequenceNode>("excludePaths");
         foreach (var pattern in excludePathsRegexPatterns)
         {
             excludePaths.Add(pattern);
@@ -121,8 +119,7 @@ public static YamlDocument AddExcludePathsRegex(this YamlDocument yamlDocument,
 
     /// <summary>
     /// Disable a certain ZAP passive scan rule for the whole scan in the ZAP Automation Framework plan. If you only
-    /// want to disable a rule for a given page, use <see cref="AddAlertFilter(YamlDocument, string, int, string, bool)"/>
-    /// instead.
+    /// want to disable a rule for a given page, use <see cref="AddDisableRuleFilter"/> instead.
     /// </summary>
     /// <param name="id">The ID of the rule. In the scan report, this is usually displayed as "Plugin Id".</param>
     /// <param name="name">
@@ -134,26 +131,19 @@ public static YamlDocument AddExcludePathsRegex(this YamlDocument yamlDocument,
     /// </exception>
     public static YamlDocument DisablePassiveScanRule(this YamlDocument yamlDocument, int id, string name = "")
     {
-        var passiveScanConfigJob = yamlDocument.GetPassiveScanConfigJobOrThrow();
-
-        if (!passiveScanConfigJob.Children.ContainsKey("rules")) passiveScanConfigJob.Add("rules", new YamlSequenceNode());
-
-        var newRule = new YamlMappingNode
+        yamlDocument.GetPassiveScanConfigJobOrThrow().AddRuleToRulesNode(new YamlMappingNode
         {
             { "id", id.ToTechnicalString() },
             { "name", name },
             { "threshold", "off" },
-        };
-
-        ((YamlSequenceNode)passiveScanConfigJob["rules"]).Add(newRule);
+        });
 
         return yamlDocument;
     }
 
     /// <summary>
     /// Disable a certain ZAP active scan rule for the whole scan in the ZAP Automation Framework plan. If you only want
-    /// to disable a rule for a given page, use <see cref="AddAlertFilter(YamlDocument, string, int, string, bool)"/>
-    /// instead.
+    /// to disable a rule for a given page, use <see cref="AddDisableRuleFilter"/> instead.
     /// </summary>
     /// <param name="id">The ID of the rule. In the scan report, this is usually displayed as "Plugin Id".</param>
     /// <param name="name">
@@ -204,19 +194,13 @@ public static YamlDocument ConfigureActiveScanRule(
             throw new ArgumentException("The \"activeScan\" job should contain a policyDefinition.");
         }
 
-        var policyDefinition = (YamlMappingNode)activeScanConfigJob["policyDefinition"];
-
-        if (!policyDefinition.Children.ContainsKey("rules")) policyDefinition.Add("rules", new YamlSequenceNode());
-
-        var newRule = new YamlMappingNode
+        activeScanConfigJob["policyDefinition"].AddRuleToRulesNode(new YamlMappingNode
         {
             { "id", id.ToTechnicalString() },
             { "name", name },
             { "threshold", threshold.ToString() },
             { "strength", strength.ToString() },
-        };
-
-        ((YamlSequenceNode)policyDefinition["rules"]).Add(newRule);
+        });
 
         return yamlDocument;
     }
@@ -225,26 +209,7 @@ public static YamlDocument ConfigureActiveScanRule(
     /// Adds an <see href="https://www.zaproxy.org/docs/desktop/addons/alert-filters/">Alert Filter</see> to the ZAP
     /// Automation Framework plan.
     /// </summary>
-    /// <param name="ruleId">The ID of the rule. In the scan report, this is usually displayed as "Plugin Id".</param>
-    /// <param name="urlMatchingRegexPattern">
-    /// A regular expression pattern to match URLs against. This should be a regex pattern that matches the whole
-    /// absolute URL, so something like ".*blog.*" to match /blog, /blog/my-post, etc.
-    /// </param>
-    /// <param name="ruleName">
-    /// The human-readable name of the rule. Not required to turn off the rule, and its value doesn't matter. It's just
-    /// useful for the readability of the method call.
-    /// </param>
-    /// <param name="isFalsePositive">
-    /// If you disable the rule because it's a false positive, then set this to <see langword="true"/>. This helps the
-    /// development of ZAP by collecting which rules have the highest false positive rate (see <see
-    /// href="https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/"/>).
-    /// </param>
-    public static YamlDocument AddAlertFilter(
-        this YamlDocument yamlDocument,
-        string urlMatchingRegexPattern,
-        int ruleId,
-        string ruleName = "",
-        bool isFalsePositive = false)
+    public static YamlDocument AddAlertFilter(this YamlDocument yamlDocument, YamlMappingNode filter)
     {
         var jobs = yamlDocument.GetJobs();
 
@@ -261,22 +226,67 @@ public static YamlDocument AddAlertFilter(
             jobs.Children.Insert(passiveScanConfigIndex + 1, alertFilterJob);
         }
 
-        if (!alertFilterJob.Children.ContainsKey("alertFilters")) alertFilterJob.Add("alertFilters", new YamlSequenceNode());
+        alertFilterJob.GetOrAddNode<YamlSequenceNode>("alertFilters").Add(filter);
+        return yamlDocument;
+    }
 
-        var newRule = new YamlMappingNode
+    /// <summary>
+    /// Adds an <see href="https://www.zaproxy.org/docs/desktop/addons/alert-filters/">Alert Filter</see> to the ZAP
+    /// Automation Framework plan.
+    /// </summary>
+    /// <param name="ruleId">The ID of the rule. In the scan report, this is usually displayed as "Plugin Id".</param>
+    /// <param name="urlMatchingRegexPattern">
+    /// A regular expression pattern to match URLs against. This should be a regex pattern that matches the whole
+    /// absolute URL, so something like ".*blog.*" to match /blog, /blog/my-post, etc.
+    /// </param>
+    /// <param name="ruleName">
+    /// The human-readable name of the rule. Not required to turn off the rule, and its value doesn't matter. It's just
+    /// useful for the readability of the method call.
+    /// </param>
+    public static YamlDocument AddDisableRuleFilter(
+        this YamlDocument yamlDocument,
+        string urlMatchingRegexPattern,
+        int ruleId,
+        string ruleName,
+        Action<YamlMappingNode> configureFilter = null)
+    {
+        var alertFilter = new YamlMappingNode
         {
             { "ruleId", ruleId.ToTechnicalString() },
             { "ruleName", ruleName },
             { "url", urlMatchingRegexPattern },
             { "urlRegex", "true" },
-            { "newRisk", isFalsePositive ? "False Positive" : "Info" },
+            { "newRisk", "Info" },
         };
 
-        ((YamlSequenceNode)alertFilterJob["alertFilters"]).Add(newRule);
+        configureFilter?.Invoke(alertFilter);
 
-        return yamlDocument;
+        return yamlDocument.AddAlertFilter(alertFilter);
     }
 
+    /// <inheritdoc cref="AddDisableRuleFilter"/>
+    /// <param name="justification">
+    /// An informational text explaining why the alert in question is false positive. This helps the development of ZAP
+    /// by collecting which rules have the highest false positive rate (see <see
+    /// href="https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/"/>).
+    /// </param>
+    public static YamlDocument AddFalsePositiveRuleFilter(
+        this YamlDocument yamlDocument,
+        string urlMatchingRegexPattern,
+        int ruleId,
+        string ruleName,
+        string justification,
+        Action<YamlMappingNode> configureFilter = null) =>
+        yamlDocument.AddDisableRuleFilter(
+            urlMatchingRegexPattern,
+            ruleId,
+            $"{ruleName}: {justification}",
+            node =>
+            {
+                configureFilter?.Invoke(node);
+                node.Children["newRisk"] = "False Positive";
+            });
+
     /// <summary>
     /// Adds a "requestor" job to the ZAP Automation Framework plan just before the job named "spider".
     /// </summary>
@@ -309,6 +319,34 @@ public static YamlDocument AddRequestor(this YamlDocument yamlDocument, string u
     /// </summary>
     public static YamlMappingNode GetRootNode(this YamlDocument yamlDocument) => (YamlMappingNode)yamlDocument.RootNode;
 
+    /// <summary>
+    /// Tries to access the child node by the name of <paramref name="key"/>. If it doesn't exists, it's created.
+    /// </summary>
+    public static T GetOrAddNode<T>(this YamlNode yamlNode, string key)
+        where T : YamlNode, new()
+    {
+        if (yamlNode is YamlMappingNode mappingNode && !mappingNode.Children.ContainsKey(key))
+        {
+            mappingNode.Children.Add(key, new T());
+        }
+
+        return (T)yamlNode[key];
+    }
+
+    /// <summary>
+    /// Adds the specified mapping to the <see cref="YamlMappingNode.Children" /> collection. If the given <paramref
+    /// name="key"/> already exists, it's removed first.
+    /// </summary>
+    public static void SetMappingChild(this YamlMappingNode node, YamlNode key, YamlNode value)
+    {
+        if (node.Children.ContainsKey(key))
+        {
+            node.Children.Remove(key);
+        }
+
+        node.Add(key, value);
+    }
+
     /// <summary>
     /// Gets the "jobs" section of the ZAP Automation Framework plan.
     /// </summary>
@@ -320,6 +358,43 @@ public static YamlSequenceNode GetJobs(this YamlDocument yamlDocument) =>
     /// </summary>
     public static YamlNode GetSpiderJob(this YamlDocument yamlDocument) => yamlDocument.GetJobByName("spider");
 
+    /// <summary>
+    /// Gets the job from the "jobs" section of the ZAP Automation Framework with the name "activeScan".
+    /// </summary>
+    public static YamlNode GetActiveScanJob(this YamlDocument yamlDocument) => yamlDocument.GetJobByName("activeScan");
+
+    /// <summary>
+    /// Gets or creates the "parameters" node under the specified <paramref name="jobNode"/>.
+    /// </summary>
+    public static YamlMappingNode GetOrCreateParameters(this YamlNode jobNode) =>
+        jobNode.GetOrAddNode<YamlMappingNode>("parameters");
+
+    /// <summary>
+    /// Updates the provided configuration parameters for the "spider" job it it exists.
+    /// </summary>
+    public static void SetSpiderParameter(this YamlDocument yamlDocument, YamlNode parameter, YamlNode value) =>
+        yamlDocument.GetSpiderJob()?.GetOrCreateParameters().SetMappingChild(parameter, value);
+
+    /// <summary>
+    /// Updates the provided configuration parameters for the "activeScan" job it it exists.
+    /// </summary>
+    public static void SetActiveScanParameter(this YamlDocument yamlDocument, YamlNode parameter, YamlNode value) =>
+        yamlDocument.GetActiveScanJob()?.GetOrCreateParameters().SetMappingChild(parameter, value);
+
+    /// <summary>
+    /// Sets time limits on the "activeScan" job. Both are in minutes. If set to 0 it means unlimited.
+    /// </summary>
+    /// <param name="maxActiveScanDurationInMinutes">Time limit for the active scan altogether.</param>
+    /// <param name="maxRuleDurationInMinutes">Time limit for the individual rule scans.</param>
+    public static void SetActiveScanMaxDuration(
+        this YamlDocument yamlDocument,
+        int maxActiveScanDurationInMinutes,
+        int maxRuleDurationInMinutes = 0)
+    {
+        yamlDocument.SetActiveScanParameter("maxScanDurationInMins", maxActiveScanDurationInMinutes.ToTechnicalString());
+        yamlDocument.SetActiveScanParameter("maxRuleDurationInMins", maxRuleDurationInMinutes.ToTechnicalString());
+    }
+
     /// <summary>
     /// Gets a job from the "jobs" section of the ZAP Automation Framework plan by its name.
     /// </summary>
@@ -341,9 +416,7 @@ public static YamlSequenceNode GetUrls(this YamlDocument yamlDocument)
     {
         var currentContext = yamlDocument.GetCurrentContext();
 
-        if (!currentContext.Children.ContainsKey("urls")) currentContext.Add("urls", new YamlSequenceNode());
-
-        return (YamlSequenceNode)currentContext["urls"];
+        return currentContext.GetOrAddNode<YamlSequenceNode>("urls");
     }
 
     /// <summary>
@@ -419,4 +492,11 @@ public static YamlDocument MergeFrom(this YamlDocument baseDocument, YamlDocumen
 
         return baseDocument;
     }
+
+    /// <summary>
+    /// Ensures that the <paramref name="parentOfRules"/> has a <c>rules</c> child and then adds the <paramref
+    /// name="newRule"/> to it.
+    /// </summary>
+    public static void AddRuleToRulesNode(this YamlNode parentOfRules, YamlNode newRule) =>
+        parentOfRules.GetOrAddNode<YamlSequenceNode>("rules").Add(newRule);
 }
diff --git a/Lombiq.Tests.UI/SecurityScanning/ZapManager.cs b/Lombiq.Tests.UI/SecurityScanning/ZapManager.cs
index addea5713..218e72176 100644
--- a/Lombiq.Tests.UI/SecurityScanning/ZapManager.cs
+++ b/Lombiq.Tests.UI/SecurityScanning/ZapManager.cs
@@ -1,6 +1,7 @@
 using CliWrap;
 using Lombiq.HelpfulLibraries.Cli;
 using Lombiq.Tests.UI.Constants;
+using Lombiq.Tests.UI.Helpers;
 using Lombiq.Tests.UI.Services;
 using Lombiq.Tests.UI.Services.GitHub;
 using Microsoft.CodeAnalysis.Sarif;
@@ -61,17 +62,6 @@ public async Task<SecurityScanResult> RunSecurityScanAsync(
         string automationFrameworkYamlPath,
         Func<YamlDocument, Task> modifyPlan = null)
     {
-        // Being able to run more than one scan in a test would complicate report generation and processing the SARIF
-        // report so rather just preventing it here (really nobody should want it anyway).
-        const string customContextKey = "ZapManager.ScanWasRun";
-
-        if (context.CustomContext.ContainsKey(customContextKey))
-        {
-            throw new NotSupportedException("You may only run a single ZAP scan in a given test.");
-        }
-
-        context.CustomContext.Add(customContextKey, string.Empty);
-
         await EnsureInitializedAsync();
 
         if (string.IsNullOrEmpty(automationFrameworkYamlPath))
@@ -79,8 +69,11 @@ public async Task<SecurityScanResult> RunSecurityScanAsync(
             automationFrameworkYamlPath = AutomationFrameworkPlanPaths.BaselinePlanPath;
         }
 
-        var mountedDirectoryPath = DirectoryPaths.GetTempSubDirectoryPath(context.Id, "Zap");
+        // Each attempt will have it's own "ZapN" directory inside the temp, starting with "Zap1".
+        var mountedDirectoryPath = DirectoryHelper.CreateEnumeratedDirectory(
+            DirectoryPaths.GetTempSubDirectoryPath(context.Id, "Zap"));
         var reportsDirectoryPath = Path.Combine(mountedDirectoryPath, _zapReportsDirectoryName);
+
         Directory.CreateDirectory(reportsDirectoryPath);
 
         // Giving write permission to all users to the reports folder. This is to avoid issues under GitHub-hosted
diff --git a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs
index 77fb8e271..29d5ae5f0 100644
--- a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs
+++ b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs
@@ -1,6 +1,7 @@
 using Lombiq.Tests.UI.Extensions;
 using Lombiq.Tests.UI.SecurityScanning;
 using Lombiq.Tests.UI.Services.GitHub;
+using Lombiq.Tests.UI.Shortcuts.Controllers;
 using OpenQA.Selenium;
 using Shouldly;
 using System;
@@ -208,4 +209,46 @@ public void AssertBrowserLogMaybe(IList<LogEntry> browserLogs, Action<string> lo
             throw;
         }
     }
+
+    /// <summary>
+    /// Sets the <see cref="AssertAppLogsAsync"/> to the output of <see cref="CreateAppLogAssertionForSecurityScan"/> so
+    /// it accepts errors in the log caused by the security scanning.
+    /// </summary>
+    public OrchardCoreUITestExecutorConfiguration UseAssertAppLogsForSecurityScan(params string[] additionalPermittedErrorLines)
+    {
+        AssertAppLogsAsync = CreateAppLogAssertionForSecurityScan(additionalPermittedErrorLines);
+
+        return this;
+    }
+
+    /// <summary>
+    /// Similar to <see cref="AssertAppLogsCanContainWarningsAsync"/>, but also permits certain <c>|ERROR</c> log
+    /// entries which represent correct reactions to incorrect or malicious user behavior during a security scan.
+    /// </summary>
+    public static Func<IWebApplicationInstance, Task> CreateAppLogAssertionForSecurityScan(params string[] additionalPermittedErrorLines)
+    {
+        var permittedErrorLines = new List<string>
+        {
+            // The model binding will throw FormatException exception with this text during ZAP active scan, when
+            // the bot tries to send malicious query strings or POST data that doesn't fit the types expected by the
+            // model. This is correct, safe behavior and should be logged in production.
+            "is not a valid value for Boolean",
+            "An unhandled exception has occurred while executing the request. System.FormatException: any",
+            // Happens when the static file middleware tries to access a path that doesn't exist or access a file as
+            // a directory. Presumably this is an attempt to access protected files using source path manipulation.
+            // This is handled by ASP.NET Core and there is nothing for us to worry about.
+            "System.IO.IOException: Not a directory",
+            // This happens when a request's model contains a dictionary and a key is missing. While this can be a
+            // legitimate application error, during a security scan it's more likely the result of an incomplete
+            // artificially constructed request. So the means the ASP.NET Core model binding is working as intended.
+            "An unhandled exception has occurred while executing the request. System.ArgumentNullException: Value cannot be null. (Parameter 'key')",
+            // One way to verify correct error handling is to navigate to ~/Lombiq.Tests.UI.Shortcuts/Error/Index, which
+            // always throws an exception. This also gets logged but it's expected, so it should be ignored.
+            ErrorController.ExceptionMessage,
+        };
+
+        permittedErrorLines.AddRange(additionalPermittedErrorLines);
+
+        return app => app.LogsShouldBeEmptyAsync(canContainWarnings: true, permittedErrorLines);
+    }
 }