Our take
Activeregular commits and releases- Activity
- 85
- Community
- 85
- Issues
- 66
- Pull requests
- 74
- Releases more often than 86% of the projects we track
- More contributors than 78% of the projects we track
- Merges more pull requests than 77% of the projects we track
ZAP is a well-maintained Java web application scanner with a broad contributor base, making it a credible option for teams that need both automated scanning and manual testing support.
Good fit if
- You want a free tool to help find web application vulnerabilities during development or testing.
- Your security work includes manual testing by experienced penetration testers.
- Your team can use a Java-based project and values an Apache-2.0 license.
Look elsewhere if
- You need a tool whose documented purpose is not web application security scanning or manual security testing.
- Your environment cannot run Java applications.
All health signals
| Last commit | 2026-11-06 (4 days ago) |
|---|---|
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 47 (latest w2026-11-02, 2026-11-02, pre-release) |
| Contributors | 100+ (top contributor: 36% of commits) |
| Issues closed, last 90 days | 26+ (typically closed in 5 days) |
| Pull requests merged, last 90 days | 57 (typically merged in 0 days) |
| Project age | 11 years |
Checked on 2026-11-11 with the GitHub API.
Project history
Daily GitHub snapshots since Nov 11, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
16,166Forks
2,703More snapshots will appear as the daily collection continues.
Overview
ZAP by Checkmarx is a Java-based web application security scanner for finding vulnerabilities while applications are being developed and tested. It is aimed both at developers who want to identify security issues during their work and at experienced penetration testers who need a tool for manual testing.
The project presents ZAP as a community-developed tool. Its repository is actively maintained, with regular commits and releases and contributions from a broad group of developers.
Key Features
- Automatically scans web applications to help find security vulnerabilities.
- Supports security testing during application development and testing.
- Can be used by experienced penetration testers for manual security testing.
- Is free to use under the Apache-2.0 license.
- Is developed in Java and uses Gradle, according to the project requirements.
Use Cases
- Developers can scan an application during development to look for security vulnerabilities before release.
- QA and security teams can include web application scanning in their testing work.
- Penetration testers can use ZAP as a tool for manual security testing.
What you need
Detected in the repository
- Java (JVM) (from Gradle)
- Automated checks on GitHub Actions
License in plain words
Apache-2.0permissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Download ZAP from the official download page. See the README and project website for details.
Alternatives
- wapiti: Wapiti is a command-line black-box scanner written in Python, while ZAP offers an interactive desktop proxy and broader manual testing features.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| zaproxy | Java | Apache-2.0 | 16.2k | Active |
| wapiti | Python | GPL-2.0 | 1.9k | Active |
Considerations
ZAP requires a Java JVM, and the repository identifies Gradle as its build system. The supplied project requirements do not indicate Docker or Compose support. The project is active, with frequent commits and releases, more than 100 contributors, and contributor work that is not concentrated in one person. Issue handling is ongoing, though the project reports a median of several days to close issues. The Apache-2.0 license is permissive, but teams should still review its terms for their intended use.
Found this useful?
Share it with someone who would like zaproxy.