OWASP ZAP
Exercising a running site you are allowed to test, with a proxy aimed at people who are new to security testing.
Last updated
- Free tier
- Unknown
- Checked
- 2026-10-13
What the public pages say
ZAP talks to a running app. That can find issues a source scanner never sees, and it can also break or flood a site. Only point it at an app you own or have permission to test. Do not run it against a production URL you share with customers until you know what the scan does.
It is a poor first step if you have not checked row level security and secret keys. Those are faster to check by hand.
Free tier
The OWASP ZAP homepage describes ZAP as a tool with a quick start guide for people new to security testing, plus automation options. The homepage on 2026-10-13 did not state a price or a license. Read the download page before treating it as free.
Not stated on the vendor's site
- License and whether a paid support offering exists.
- Which checks it runs by default.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/owasp-zap