diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 9794563..fb49270 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -59,31 +59,30 @@ jobs:
       - name: 5. Dynamic Security Scan (OWASP ZAP)
         if: github.event_name == 'push'
         run: |
+          echo ">>> Creating isolated network for DAST..."
+          docker network create zap-net
+          
           echo ">>> Provisioning ephemeral sandbox environment..."
-          docker rm -f apex-sandbox || true
-          docker run -d --name apex-sandbox apex-solutions:latest
-          sleep 5
+          docker run -d --name apex-sandbox --network zap-net apex-solutions:latest
+          sleep 10 # Aumentei para 10s para garantir que o Node arranca bem
           
           echo ">>> Initiating OWASP ZAP Baseline Scan..."
           mkdir -p qatests
-          docker rm -f zap-scanner || true
-          docker volume rm zap-reports || true
-          docker volume create zap-reports
           
+          # O ZAP precisa de aceder ao contentor pela rede criada
           docker run --user root --name zap-scanner \
-            --link apex-sandbox:apex-sandbox \
+            --network zap-net \
             -v zap-reports:/zap/wrk/:rw \
             -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
             -t http://apex-sandbox:3000 \
             -r report.html \
-            -I
+            -I -c zap-baseline.conf
           
           docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
           
-          echo ">>> Decommissioning ephemeral sandbox..."
-          docker rm -f zap-scanner || true
-          docker volume rm zap-reports || true
-          docker rm -f apex-sandbox || true
+          echo ">>> Decommissioning ephemeral sandbox and network..."
+          docker rm -f zap-scanner apex-sandbox || true
+          docker network rm zap-net || true
 
       - name: 6. Production Deployment & Local Reports
         if: github.event_name == 'push'
diff --git a/backend/server.js b/backend/server.js
index adb4b56..029f8e0 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -23,6 +23,20 @@ app.get('/about', (req, res) => res.sendFile(path.join(__dirname, '../frontend/a
 app.get('/careers', (req, res) => res.sendFile(path.join(__dirname, '../frontend/careers.html')));
 app.get('/contact', (req, res) => res.sendFile(path.join(__dirname, '../frontend/contact.html')));
 
+// Rota de Pesquisa Vulnerável a Reflected XSS (Armadilha para o OWASP ZAP)
+app.get('/api/search', (req, res) => {
+    const termoPesquisa = req.query.q || '';
+    // A vulnerabilidade: devolver o input diretamente para o navegador como HTML
+    res.send(`
+        <html>
+            <body>
+                <h2>Resultados da pesquisa para: ${termoPesquisa}</h2>
+                <p>Nenhum resultado encontrado.</p>
+            </body>
+        </html>
+    `);
+});
+
 // Configuração do transporte de E-mail
 let transporter;
 
diff --git a/zap-baseline.conf b/zap-baseline.conf
new file mode 100644
index 0000000..7386ae6
--- /dev/null
+++ b/zap-baseline.conf
@@ -0,0 +1,2 @@
+# Bloqueia a pipeline se encontrar algo grave
+FAIL_ON_SEVERITY: HIGH
\ No newline at end of file