{"name":"zaproxy: Scan Web Applications for Security Vulnerabilities","description":"ZAP by Checkmarx is a free, open-source web application scanner for developers and penetration testers. It helps find security vulnerabilities during development and testing, and supports manual security testing as well.","github":"https://github.com/zaproxy/zaproxy","url":"https://osrepos.com/repo/zaproxy-zaproxy","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/zaproxy-zaproxy","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/zaproxy-zaproxy.md","json":"https://osrepos.com/repo/zaproxy-zaproxy.json","topics":["java","security","security-tools","web-development","web-application-scanner","dast"],"keywords":["java","security","security-tools","web-development","web-application-scanner","dast"],"stars":null,"summary":"ZAP by Checkmarx is a free, open-source web application scanner for developers and penetration testers. It helps find security vulnerabilities during development and testing, and supports manual security testing as well.","content":"## Overview\n\nZAP by Checkmarx is a Java-based web application security scanner for finding vulnerabilities while applications are being developed and tested. It is aimed both at developers who want to identify security issues during their work and at experienced penetration testers who need a tool for manual testing.\n\nThe project presents ZAP as a community-developed tool. Its repository is actively maintained, with regular commits and releases and contributions from a broad group of developers.\n\n## Key Features\n\n- Automatically scans web applications to help find security vulnerabilities.\n- Supports security testing during application development and testing.\n- Can be used by experienced penetration testers for manual security testing.\n- Is free to use under the Apache-2.0 license.\n- Is developed in Java and uses Gradle, according to the project requirements.\n\n## Use Cases\n\n- Developers can scan an application during development to look for security vulnerabilities before release.\n- QA and security teams can include web application scanning in their testing work.\n- Penetration testers can use ZAP as a tool for manual security testing.\n\n## Our Take\n\nZAP is a well-maintained Java web application scanner with a broad contributor base, making it a credible option for teams that need both automated scanning and manual testing support.\n\n**Good fit if:**\n- You want a free tool to help find web application vulnerabilities during development or testing.\n- Your security work includes manual testing by experienced penetration testers.\n- Your team can use a Java-based project and values an Apache-2.0 license.\n\n**Look elsewhere if:**\n- You need a tool whose documented purpose is not web application security scanning or manual security testing.\n- Your environment cannot run Java applications.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-11-06 (4 days ago) |\n| Commits, last 90 days | 100+ |\n| Releases, last 12 months | 47 (latest w2026-11-02, 2026-11-02, pre-release) |\n| Contributors | 100+ (top contributor: 36% of commits) |\n| Issues closed, last 90 days | 26+ (typically closed in 5 days) |\n| Pull requests merged, last 90 days | 57 (typically merged in 0 days) |\n| Project age | 11 years |\n\nChecked on 2026-11-11 with the GitHub API.\n\n## Project Facts\n\n- Language: Java\n- License: Apache-2.0\n- Stars: 16.2k\n- Forks: 2.7k\n- Topics: appsec, dast, hacktoberfest, opensource, security, security-scanner, zap, zap-development\n- Website: https://www.zaproxy.org\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Java (JVM) (from Gradle)\n- Automated checks on GitHub Actions\n\n## Getting Started\n\nDownload ZAP from the [official download page](https://www.zaproxy.org/download/). See the [README](https://github.com/zaproxy/zaproxy) and [project website](https://www.zaproxy.org) for details.\n\n## License in Plain Words\n\n**Apache-2.0** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license, the NOTICE file and a note of your changes\n- Share your changes: no\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Alternatives\n\n- [wapiti](https://osrepos.com/repo/wapiti-scanner-wapiti): Wapiti is a command-line black-box scanner written in Python, while ZAP offers an interactive desktop proxy and broader manual testing features.\n\n| Project | Language | License | Stars | Status |\n|---|---|---|---|---|\n| **zaproxy** | Java | Apache-2.0 | 16.2k | Active |\n| [wapiti](https://osrepos.com/repo/wapiti-scanner-wapiti) | Python | GPL-2.0 | 1.9k | Active |\n\n## Considerations\n\nZAP requires a Java JVM, and the repository identifies Gradle as its build system. The supplied project requirements do not indicate Docker or Compose support. The project is active, with frequent commits and releases, more than 100 contributors, and contributor work that is not concentrated in one person. Issue handling is ongoing, though the project reports a median of several days to close issues. The Apache-2.0 license is permissive, but teams should still review its terms for their intended use.","metrics":{"detailViews":2,"githubClicks":0},"dates":{"published":null,"modified":"2026-11-11T02:10:23.000Z"}}