Zed Attack Proxy@zaproxy

Official announcements (low vol) for ZAP by @Checkmarx - the worlds most popular web app scanner. Free and open source. infosec.exchange/@zaproxy

zaproxy.org
Joined June 2011
70 Photos and videos
Want to learn more about ZAP? The latest tutorial videos are all linked off zaproxy.org/videos/ - we're adding to them all of the time.
6
46
96
The latest weekly release does not include the AJAX Spider and DOM XSS add-ons. You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead. For more details see zaproxy.org/blog/2026-09-08-… #zaproxy #appsec

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
7
10
554
ZAP updates for August. We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications. zaproxy.org/blog/2026-09-08-… #zaproxy #appsec

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
1
6
8
508
ZAP's Technology Detection add-on got a new icon in today's release.
1
5
1,044
Introducing ZAP LLM Support: zaproxy.org/blog/2026-08-07-… A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice. #zaproxy #appsec

The ZAP LLM Support Add-on

A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.

zaproxy.org
8
17
1,294
zaproxy.org/blog/2026-08-06-… - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider #zaproxy #appsec

ZAP Updates - July 2026

ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.

zaproxy.org
4
13
1,361
It has been 3 years since ZAP left @owasp Update your docs! zaproxy.org/docs/nowaspzap/

N⛔WASP ZAP

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP...

zaproxy.org
4
16
1,269
Zed Attack Proxy retweeted
Zed Attack Proxy@zaproxy
Jul 6
Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

zaproxy.org
4
10
846
ZAP Blog: June Updates zaproxy.org/blog/2026-07-01-… More PTK integration, lots of Client Spider improvements, and much more.. #zaproxy #appsec

ZAP Updates - June 2026

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client...

zaproxy.org
4
6
1,008
Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. zaproxy.org/blog/2026-06-29-… @pentestkit #zaproxy #owaspptk #appsec

Even More OWASP PTK Integration with ZAP

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control...

zaproxy.org
4
5
666
An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via @neo_ai_engineer Update your ZAP add-ons now, and definitely update from older versions of ZAP. For more details see: zaproxy.org/blog/2026-06-24-…

Java Deserialization Vulnerability in ZAP Viewstate Add-on

A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.

zaproxy.org
5
14
1,252
ZAP now has a dedicated OWASP PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. Check out the dramatic improvement in the scores vs Google Firing Range! zaproxy.org/blog/2026-06-05-… #zaproxy #owaspptk #appsec

Automating OWASP PTK with ZAP (Phase 2)

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!

zaproxy.org
6
5
2,027
In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on. zaproxy.org/blog/2026-06-02-… #zaproxy #appsec

ZAP Updates - May 2026

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.

zaproxy.org
9
7
895
ZAP can now scan MCP Servers, in the Desktop, Automation Framework and in a new GitHub Action. Read all about it on the blog: zaproxy.org/blog/2026-05-21-… #zaproxy #appsec #mcp

Scanning MCP Servers with ZAP

ZAP can now scan MCP (Model Context Protocol) servers as a first-class target. Import an MCP server from the ZAP desktop or the Automation Framework, or run the new action-mcp-scan GitHub Action to...

zaproxy.org
15
26
1,892
ZAP April report zaproxy.org/blog/2026-05-01-… Nearly 10 Million runs, and over 15,000 GitHub stars! #zaproxy #appsec

ZAP Updates - April 2026

ZAP was started nearly 10 million times in April, and the main zaproxy repo hit 15,000 GitHub stars. Read on for blog post summaries and the full add-on changelog.

zaproxy.org
3
7
461
Blog: Automating OWASP PTK with ZAP (Phase 1) You can now automate @OWASP @pentestkit using ZAP zaproxy.org/blog/2026-05-06-… #zaproxy #owasp #appsec

Automating OWASP PTK with ZAP (Phase 1)

ZAP’s Automation Framework can now drive OWASP PTK scans using the Client Spider. This is an early release - we want you to try it and give us feedback while we work toward deeper integration with...

zaproxy.org
9
18
3,475
Shout out to github.com/sariseko55 for being the 15,000th person to star ⭐️ the @zaproxy core repo on Friday the 17th 🎉 #GitHub #Achievement

sariseko55 - Overview

sariseko55 has 2 repositories available. Follow their code on GitHub.

github.com
2
7
516
Blog: Vibe coding security fixes. zaproxy.org/blog/2026-04-15-… Learn how ZAP can help you make your vibe coded projects more secure. #zaproxy #vibecoding #appsec

Vibe Coding Security Fixes

ZAP now has a “Generate Fix Prompt” option that copies everything an LLM needs to fix a vulnerability straight to your clipboard. Also: ZAP was run 9.5 million times in March. Vibe coding, anyone?

zaproxy.org
7
9
775
Guest Blog: zaproxy.org/blog/2026-04-13-… Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment. ℅ Trevor Mountney #zaproxy #kubernetes #appsec

Use ZAP with KRO in Kubernetes

Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.

zaproxy.org
3
11
728
Blog: ZAP Updates for March: zaproxy.org/blog/2026-04-03-… ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects Cc @javamuffinztx @seqradev @pentestkit #zaproxy #appsec

ZAP Updates - March 2026

ZAP was started nearly 9.5 million times in March, published integrations with 3 other open source projects, and released the first of many AI related features.

zaproxy.org
1
10
24
1,393
Load more