OWASP ZAP

Background

OWASP ZAP, short for Zed Attack Proxy, is a free and open-source web application security scanner. It is designed to help find security vulnerabilities in web applications during development and testing, and is also used by experienced penetration testers for manual security assessments. ZAP operates as an intercepting proxy, sitting between a tester's browser and a target web application so that requests and responses can be inspected, modified, and automatically scanned for common vulnerability classes such as SQL injection and cross-site scripting.

Origins

ZAP originated as a fork of Paros Proxy, an earlier Java-based web proxy and vulnerability scanner developed by Chinotec Technologies. An initial build of ZAP was announced publicly on the Bugtraq mailing list in September 2010. Later that year, the project was adopted under the Open Web Application Security Project (OWASP), which provided it with a governance structure, branding, and a community of contributors. Simon Bennetts became the project lead and, over the following years, oversaw a substantial rewrite of the codebase; by around 2014 the majority of the original Paros-derived code had reportedly been replaced.

Development and Growth

Written primarily in Java and released under the Apache License, ZAP is cross-platform, running on Linux, Windows, and macOS, and has been translated into numerous languages. Over the 2010s, it grew into one of OWASP's flagship projects and one of the most actively developed open-source security tools on GitHub, accumulating an extensive add-on marketplace that extends its core scanning, fuzzing, and automation capabilities. It supports both a traditional graphical interface aimed at newcomers to security testing and a headless/automation mode intended for integration into continuous integration and continuous delivery (CI/CD) pipelines, reflecting a broader industry shift toward automated security testing (DevSecOps).

Recognition

ZAP's prominence within the open-source security community was reflected in industry recognition, including an InfoWorld Bossie Award in 2015 for best open-source networking and security software. It has consistently been cited as among the most widely used web application security scanners, valued both for being free to use and for its extensibility through community-built add-ons.

Governance Changes and Legacy

In August 2023, the core ZAP development team moved the project's stewardship to the Linux Foundation's Software Security Project umbrella, aiming to place its long-term sustainability on a more formal institutional footing while keeping it open source. In September 2024, the main ZAP developers joined the application security company Checkmarx as employees, and the project was rebranded as "ZAP by Checkmarx," while remaining a freely available, community-driven open-source tool under the Apache license. Today, ZAP remains widely cited in security training, bug bounty methodology, and DevSecOps pipelines as a standard, no-cost option for dynamic web application security testing, and its long history of iterative rewrites and governance transitions makes it a notable case study in how open-source security tooling can mature over more than a decade while remaining free and community accessible.

Timeline

• 2010-09An initial build of ZAP, forked from Paros Proxy, is announced publicly on the Bugtraq mailing list.
• 2010ZAP is adopted as a project of the Open Web Application Security Project (OWASP).
• 2014By this point, an estimated 80% of ZAP's original Paros-derived codebase has been rewritten under project lead Simon Bennetts.
• 2015ZAP receives an InfoWorld Bossie Award for best open-source networking and security software.
• 2023-08The core ZAP development team moves project stewardship to the Linux Foundation's Software Security Project.
• 2024-09ZAP's main developers join Checkmarx as employees; the project is rebranded as "ZAP by Checkmarx" while remaining free and open source.