The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.

ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP b...

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client Spider...

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control ove...

A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP b...

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.

ZAP can now scan MCP (Model Context Protocol) servers as a first-class target. Import an MCP server from the ZAP desktop or the Automation Framework, or run the new action-mcp-scan GitHub Action to sc...

ZAP’s Automation Framework can now drive OWASP PTK scans using the Client Spider. This is an early release - we want you to try it and give us feedback while we work toward deeper integration with ZAP...

ZAP now has a “Generate Fix Prompt” option that copies everything an LLM needs to fix a vulnerability straight to your clipboard. Also: ZAP was run 9.5 million times in March. Vibe coding, anyone?

Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.

ZAP was started nearly 9.5 million times in March, published integrations with 3 other open source projects, and released the first of many AI related features.

OWASP PTK 9.8.0 and the ZAP OWASP PTK add-on 0.3.0 now let ZAP display OWASP PTK findings directly as ZAP Alerts. This post shows how to install the add-on, choose which PTK rules to run (SAST / IAST ...

Introducing DeepViolet: The Engine Behind ZAP’s New TLS Analysis

February was another busy month for the ZAP project, with improvements across browser automation, GraphQL and the Encode/Decode/Hash add-on.

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.

ZAP can now detect cycles in GraphQL schemas that could lead to denial of service attacks.

Highlights of 2025 and our initial plans for 2026, including more 3rd Party tool integrations, enhanced exploring and, yes, AI integration!

OWASP PTK is now pre-installed in the browsers launched by ZAP (Chrome, Edge and Firefox). This post shows how to run PTK’s DAST, IAST, SAST, and SCA inside the same authenticated session you’re testi...

The world’s most widely used web app scanner. Free and open source. ZAP is a community project actively maintained by a dedicated international team, and a GitHub Top 1000 project.

Dear aspiring Open Source contributors: If you spent X minutes to let your AI tool make some "enhancement", "refactoring", or "clean up", and it takes the project maintainer >X minutes to review and l...

ZAP 2.17.0 has just been released. The release includes core performance improvements and will significantly reduce the number of “duplicate” alerts reported.

React2Shell is the latest big “named” vulnerability - heres how you can detect it with ZAP.

2.17.0 is coming soon, along with Insights and fixes for some issues that caused ZAP to log 50 million errors in one day!

Building an intelligent security testing system that leverages ZAP’s automation capabilities and machine learning to improve vulnerability detection

ZAP logged a LOT of errors yesterday - heres why, and what we have already done to address the underlying problems

File Checksum (SHA-256) ZAP_WEEKLY_D-2025-11-24.zip 6a0bab4207bdd498c24fd0edc6eddfa0789cf80510a8290ba3481d573458ccf2

Welcome to Cloudflare's home for real-time and historical data on system performance.

Systemic alerts, check for updates bug, auth improvements, project pulse, etc See what the ZAP team has been up to.

A new ZAP scan rule unintentionally caused a Check for Updates call even when “silent” mode was used.

Configuring scan policies with alert tags, WAVSEP adoption, alert de-duplication and a new add-on publishing guide.

How and why we will be reporting fewer “duplicate” alerts in ZAP.

The world’s most widely used web app scanner. Free and open source. ZAP is a community project actively maintained by a dedicated international team, and a GitHub Top 1000 project.

The ZAP team has forked and will maintain WAVSEP going forwards. This blog post explains why.

A new feature in ZAP’s automation framework allows you to configure scan policies using alert tags, making it easier to target specific types of vulnerabilities without manually managing individual sc...

Microsoft Online Login Support, forking wavsep and much, much more!

Help us translate ZAP Help and bring it to the world!

The world’s most widely used web app scanner. Free and open source. ZAP is a community project actively maintained by a dedicated international team, and a GitHub Top 1000 project.

Authentication improvements, Edge support, timing rule changes, Docker news, and a new scan rule.