# zaproxy: Scan Web Applications for Security Vulnerabilities This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/zaproxy-zaproxy Generated for open source discovery and AI-assisted research. ZAP by Checkmarx is a free, open-source web application scanner for developers and penetration testers. It helps find security vulnerabilities during development and testing, and supports manual security testing as well. GitHub: https://github.com/zaproxy/zaproxy OSRepos URL: https://osrepos.com/repo/zaproxy-zaproxy ## Summary ZAP by Checkmarx is a free, open-source web application scanner for developers and penetration testers. It helps find security vulnerabilities during development and testing, and supports manual security testing as well. ## Topics - java - security - security-tools - web-development - web-application-scanner - dast ## Repository Information Last analyzed by OSRepos: Wed Nov 11 2026 02:10:23 GMT+0000 (Western European Standard Time) Detail views: 2 GitHub clicks: 0 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview ZAP by Checkmarx is a Java-based web application security scanner for finding vulnerabilities while applications are being developed and tested. It is aimed both at developers who want to identify security issues during their work and at experienced penetration testers who need a tool for manual testing. The project presents ZAP as a community-developed tool. Its repository is actively maintained, with regular commits and releases and contributions from a broad group of developers. ## Key Features - Automatically scans web applications to help find security vulnerabilities. - Supports security testing during application development and testing. - Can be used by experienced penetration testers for manual security testing. - Is free to use under the Apache-2.0 license. - Is developed in Java and uses Gradle, according to the project requirements. ## Use Cases - Developers can scan an application during development to look for security vulnerabilities before release. - QA and security teams can include web application scanning in their testing work. - Penetration testers can use ZAP as a tool for manual security testing. ## Our Take ZAP is a well-maintained Java web application scanner with a broad contributor base, making it a credible option for teams that need both automated scanning and manual testing support. **Good fit if:** - You want a free tool to help find web application vulnerabilities during development or testing. - Your security work includes manual testing by experienced penetration testers. - Your team can use a Java-based project and values an Apache-2.0 license. **Look elsewhere if:** - You need a tool whose documented purpose is not web application security scanning or manual security testing. - Your environment cannot run Java applications. ## Project Health | Signal | Value | |---|---| | Status | **Active**: regular commits and releases | | Last commit | 2026-11-06 (4 days ago) | | Commits, last 90 days | 100+ | | Releases, last 12 months | 47 (latest w2026-11-02, 2026-11-02, pre-release) | | Contributors | 100+ (top contributor: 36% of commits) | | Issues closed, last 90 days | 26+ (typically closed in 5 days) | | Pull requests merged, last 90 days | 57 (typically merged in 0 days) | | Project age | 11 years | Checked on 2026-11-11 with the GitHub API. ## Project Facts - Language: Java - License: Apache-2.0 - Stars: 16.2k - Forks: 2.7k - Topics: appsec, dast, hacktoberfest, opensource, security, security-scanner, zap, zap-development - Website: https://www.zaproxy.org - Archived: no ## What You Need Detected in the repository: - Java (JVM) (from Gradle) - Automated checks on GitHub Actions ## Getting Started Download ZAP from the [official download page](https://www.zaproxy.org/download/). See the [README](https://github.com/zaproxy/zaproxy) and [project website](https://www.zaproxy.org) for details. ## License in Plain Words **Apache-2.0** (permissive). - Commercial use: yes - Modify and redistribute: yes - You must keep: the license, the NOTICE file and a note of your changes - Share your changes: no - Includes an explicit patent grant from the contributors A summary, not legal advice: the LICENSE file is what applies. ## Alternatives - [wapiti](https://osrepos.com/repo/wapiti-scanner-wapiti): Wapiti is a command-line black-box scanner written in Python, while ZAP offers an interactive desktop proxy and broader manual testing features. | Project | Language | License | Stars | Status | |---|---|---|---|---| | **zaproxy** | Java | Apache-2.0 | 16.2k | Active | | [wapiti](https://osrepos.com/repo/wapiti-scanner-wapiti) | Python | GPL-2.0 | 1.9k | Active | ## Considerations ZAP requires a Java JVM, and the repository identifies Gradle as its build system. The supplied project requirements do not indicate Docker or Compose support. The project is active, with frequent commits and releases, more than 100 contributors, and contributor work that is not concentrated in one person. Issue handling is ongoing, though the project reports a median of several days to close issues. The Apache-2.0 license is permissive, but teams should still review its terms for their intended use.