ZAP
Security Testing · by Checkmarx (sponsor), open source
ZAP is a free, open-source web application security scanner that works as an intercepting proxy and can run automated scans in CI.
Research status: Not yet verified
Product capabilities
- Intercepting proxy
- Automated active and passive scans
- API scanning from OpenAPI
- Docker images for CI
Main use cases
- Baseline security checks in CI
- Manual exploration of web apps
- Learning security testing
Supported integrations
- GitHub Actions
- Jenkins
- Docker
Advantages
- Free
- Large community and add-ons
Limitations
- Findings need manual triage
- Not a replacement for a professional penetration test