# ZAP

> ZAP (Zed Attack Proxy) is a free, open-source web application security scanner and interception proxy for developers, testers and security specialists. It combines automated checks, manual testing and programmable workflows. The independent project is controlled by its core team and backed by Checkmarx, which employs three project leaders.

- **Founded:** 2010
- **Headquarters:** Distributed project; supporting company registered in Stockport, United Kingdom
- **Founders:** Simon Bennetts (Founder and project leader)
- **Products:** Zed Attack Proxy, Automation Framework, ZAP Marketplace, Client Spider, Professional services via ZAProxy Ltd
- **Notable:** First released by Simon Bennetts in 2010., Used in Mozilla’s published 2021 programme of daily baseline scans against 241 sites., 13,295,706 reported starts in July 2026.

## Products & services

- **Zed Attack Proxy** — Desktop and headless interception proxy with passive analysis, active vulnerability scanning and manual testing tools. Runs on Windows, macOS and Linux; container images are available.
- **Automation Framework** — YAML-based scan plans for repeatable application-security workflows, including authentication, crawling, scanning and reports.
- **ZAP Marketplace** — Community and project add-ons extend protocol support, scan rules, scripting, reports and integrations.
- **Client Spider** — Browser-extension-assisted discovery for JavaScript-heavy applications; introduced in 2.16.0 and recommended over AJAX Spider for modern apps from July 2026.
- **Professional services via ZAProxy Ltd** — Support packages, sponsored development and consultancy launched in April 2024 to fund project work; the announcement is historical and current availability should be confirmed.
- **LLM Support add-on** — Optional, opt-in connection to user-configured model providers, with chat and integrations for OpenAPI import and alert review.
- **Browser Extension Script Viewer** — Version 0.3.0 adds viewing, editing and step-by-step replay of supported recorded Zest scripts in the browser.

## Achievements

- First released by Simon Bennetts in 2010.
- Used in Mozilla’s published 2021 programme of daily baseline scans against 241 sites.
- 13,295,706 reported starts in July 2026.
- Maintained open-source Apache 2.0 licensing under the 2024 Checkmarx arrangement.

## Latest updates

- **2026-10** — October 21: Browser Extension 0.3.0 Script Viewer adds live script inspection, editing and replay for supported Zest statements.
- **2026-10** — October 13: Contributor guidance identifies code review as a bottleneck and asks for smaller, well-tested contributions.
- **2026-10** — October 8: Initial OAuth2 authentication support covers client_credentials and password grants for API testing; browser login flows should use browser-based or client-script authentication.
- **2026-08** — August 7: Optional LLM Support add-on announced with configurable providers and integrations.
- **2026-07** — July 6: Client Spider becomes the recommended crawler for modern web applications.

## Links

- Website: https://www.zaproxy.org/
- Twitter/X: https://twitter.com/zaproxy
- GitHub: https://github.com/zaproxy
- YouTube: https://www.youtube.com/@psiinon
- Bluesky: https://bsky.app/profile/zaproxy.org

---

Profile page: https://yespress.io/zap
Published by YesPress — https://yespress.io
Last updated: 2026-10-23