OWASP ZAP
What it is
ZAP, also identified as ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing. Its scanning tools include active and passive scans, a spider, alerts, and scan policies. Add-ons are available through an online Marketplace and are typically added or removed without restarting the application. The Automation Framework uses YAML plans to run jobs such as scanning, spidering, API imports, and report generation. ZAP provides GitHub Actions for baseline, full, and API scans through Docker-packaged scans. The framework can import OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons. Published Docker images include a bare image described as minimal and suitable for CI. ZAP supports Linux, macOS, Windows, API use, and self-hosted deployment. Windows and Linux installers require Java 17 or later, while the macOS installer includes Java 17. The project says it can support only the latest full release. Current releases are unsigned, and checksums are provided for downloads. ZAP is designed for developers, testers new to security testing, and security testing specialists.
For and against
For
- Includes active and passive scanning, spidering, alerts, and policies.
- YAML plans can automate scans and report generation.
- GitHub Actions support baseline, full, and API scans.
- OpenAPI, GraphQL, SOAP, and Postman definitions can be imported.
Against
- Windows and Linux installers require Java 17 or higher.
- The team supports only the latest full release.
- Current releases are unsigned; checksums are provided.
The verdict
ZAP combines scanning with automation, API imports, and CI integrations at no cost. Check the Java requirement for your platform and verify downloaded files with the provided checksums.
Who it suits
ZAP is intended for developers, testers new to security testing, and security testing specialists. Its automation and CI options may suit teams incorporating web application scans into their workflows.
Plans and prices
Free / open source
full ZAP functionality · desktop, command line, Docker and API use
Read 15 Oct 2026 · zaproxy.org
ZAP
Free and open source · add-ons available in the Marketplace
Read 29 Sep 2026 · zaproxy.org
On the record
- Active scanning
- The feature set includes active scanning that sends attack requests to identify vulnerabilities.zaproxy.org · read 15 Oct 2026
- Add-ons
- Add-ons can be installed dynamically from the online Marketplace, and are typically added or removed without restarting ZAP.zaproxy.org · read 29 Sep 2026
- API
- The API and daemon mode provide programmatic control over ZAP, including scanner and spider operations.zaproxy.org · read 15 Oct 2026
- API formats
- The Automation Framework supports importing OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons.zaproxy.org · read 29 Sep 2026
- Audience
- ZAP says it is designed for developers, testers new to security testing, and security testing specialists.zaproxy.org · read 29 Sep 2026
- Authentication
- Authentication features include browser-based, script-based, header-based and OAuth2 methods through the Authentication Helper add-on.zaproxy.org · read 15 Oct 2026
- Automation
- The Automation Framework controls ZAP with a YAML plan and supports jobs including active scanning, passive scanning, spidering, API imports, and report generation.zaproxy.org · read 29 Sep 2026
- Automation integrations
- Automation options include Docker packaged scans, GitHub Actions, the Automation Framework, command line, ZAPit and API/daemon mode.zaproxy.org · read 15 Oct 2026
- CI integration
- ZAP provides GitHub Actions for baseline, full, and API scans through its Docker packaged scans.zaproxy.org · read 29 Sep 2026
- Company fact: Checkmarx support
- The official ownership page says three ZAP Core Team members are employed by Checkmarx to work on ZAP.zaproxy.org · read 15 Oct 2026
- Company fact: OWASP Foundation
- LinkedIn lists the OWASP Foundation as a Wilmington, Delaware nonprofit founded in 2001, with a stated company size of 2–10 employees.linkedin.com · read 15 Oct 2026
- Current release
- Release 2.17.0 is described as a bug-fix and enhancement release with alert deduplication, systemic alerts, an Insights tab and improved disk and memory handling.zaproxy.org · read 15 Oct 2026
- Deployment
- ZAP publishes Docker images, including a bare image described as minimal and ideal for CI.zaproxy.org · read 29 Sep 2026
- Distribution security warning
- The download page warns that releases are currently unsigned and that browsers or antivirus tools may flag them.zaproxy.org · read 15 Oct 2026
- Documentation
- The project publishes getting-started material, a desktop user guide, developer guide, API reference, automation documentation, videos and community resources.zaproxy.org · read 15 Oct 2026
- Download security
- The download page warns that current ZAP releases are unsigned and provides checksums for downloads.zaproxy.org · read 29 Sep 2026
- Extensibility
- The Marketplace distributes team and community add-ons, and users can publish their own add-ons.zaproxy.org · read 15 Oct 2026
- Licence
- The ZAP software package is open source under Apache License 2.0, with separately licensed third-party libraries.github.com · read 15 Oct 2026
