Owner

zaproxy

13 indexed repositories · View on GitHub

zaproxy
The ZAP by Checkmarx Core project

Java · 15789 stars
community-scripts
A collection of ZAP scripts and tips provided by the community - pull requests very welcome!

JavaScript · 895 stars
action-full-scan
A GitHub Action for running the ZAP Full scan

JavaScript · 385 stars
action-baseline
A GitHub Action for running the ZAP Baseline scan

JavaScript · 372 stars
zap-hud
The ZAP Heads Up Display (HUD)

Java · 276 stars
zest

Java · 117 stars
zaproxy-website
The source of ZAP website

HTML · 82 stars
action-api-scan
A GitHub Action for running the ZAP API scan

JavaScript · 77 stars
zap-api-nodejs

JavaScript · 60 stars
zap-api-docs
ZAP API Documentation

JavaScript · 40 stars
browser-extension

TypeScript · 38 stars
zap-admin
ZAP Admin

Java · 35 stars
actions-common
Common code for ZAP's GitHub Actions

TypeScript · 4 stars

Beginner friendly Everything

Open All

Selenium scripts run asynchronously for the Client Spider, causes race between the scripts and the crawl Open

add-on bug

Difficulty 3/5 1-2 days Newbie friendliness 74/100

zaproxy/zaproxy#9472 · Opened Sep 18, 2026
Modern spider doesn't respect the specified time limit Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

zaproxy/zaproxy#9471 · 1 comment · Opened Sep 18, 2026
Add support for HTTP/3 Open

add-on enhancement in:network

Difficulty 5/5 Over a week Newbie friendliness 35/100

zaproxy/zaproxy#9463 · 2 comments · Opened Sep 13, 2026
UserControlledHTMLAttributesScanRule meta handing lacks minimum length guard leading to false positives Open

add-on FalsePositive in:pscanrules

zaproxy/zaproxy#9461 · 4 comments · 1 assignee · Opened Sep 11, 2026
AlertOnUnexpectedContentTypes.js reports false positive for application/grpc header Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

zaproxy/community-scripts#524 · 1 comment · Opened Sep 7, 2026
gRPC add-on fails to handle native application/grpc bodies because VariantGrpc assumes Base64 Open

add-on bug in:grpc

zaproxy/zaproxy#9450 · 5 comments · 1 assignee · Opened Sep 3, 2026
Missing exclude path in FullScanDvwaAuth.yaml Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

zaproxy/community-scripts#522 · 1 comment · Opened Aug 31, 2026
Session persistence fails with HSQLDB RowInputBinary / EOFException due to corrupt HISTORY index Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

zaproxy/zaproxy#9445 · 4 comments · Opened Aug 31, 2026
Client Spider gives up on slow-booting SPAs: out-of-scope asset downloads do not count as page activity Open

add-on in:client

zaproxy/zaproxy#9440 · 4 comments · 1 assignee · Opened Aug 26, 2026
SOAP add-on: SSRF + local-file access via wsdl:import/xsd:import (auto-triggered by WSDL spider) Open

add-on in:soap

zaproxy/zaproxy#9438 · 1 reaction · 1 assignee · Opened Aug 25, 2026
Unable to connect to httpforever.com, natas0.natas.labs.overthewire.org due to ZAP's http header changes Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

zaproxy/zaproxy#9428 · 11 comments · Opened Aug 20, 2026
[Site-tree] Add newly found subdomains and links as node to Sites without visiting the url. Open

marketplace

Difficulty 5/5 Over a week Newbie friendliness 25/100

zaproxy/zaproxy#9426 · 5 comments · Opened Aug 19, 2026
graphql: Imports may fail silently Open

add-on bug Component-UI in:graphql Usability

Difficulty 3/5 1-2 days Newbie friendliness 64/100

zaproxy/zaproxy#9407 · Opened Jul 24, 2026
CSP: meta http-equiv set by angular and response header set by nginx should be correlated before raising an alert Open

FalsePositive in:pscanrules

zaproxy/zaproxy#9403 · 4 comments · 1 assignee · Opened Jul 22, 2026
Unable to specify rules with dashes in OUTOFSCOPE/IGNORE rules Open

Docker enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

zaproxy/zaproxy#9394 · 3 comments · Opened Jul 16, 2026
Login URL field not showing automatically in Authentication tester form Open

add-on bug Component-UI in:authhelper Usability

zaproxy/zaproxy#9387 · 1 comment · 1 assignee · Opened Jul 12, 2026
Browsers launched by the Client Spider re-request the same static resources repeatedly Open

Difficulty 3/5 1-2 days Newbie friendliness 66/100

zaproxy/zaproxy#9386 · 4 comments · Opened Jul 10, 2026
Filtering a rule does not work on ZAP Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

zaproxy/zaproxy#9385 · 2 comments · Opened Jul 10, 2026
`deleteAlerts` and `deleteAlert` throw a `NullPointerException` when an alert has an invalid site node reference Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

zaproxy/zaproxy#9383 · 1 comment · Opened Jul 9, 2026
`DeleteAlerts` endpoint does not delete duplicate alerts Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 78/100

zaproxy/zaproxy#9382 · Opened Jul 9, 2026
Add-on submission: Disclosure Contact Lookup (disclose/zap-lookup) Open

marketplace

Difficulty 4/5 3-5 days Newbie friendliness 35/100

zaproxy/zaproxy#9377 · 4 comments · Opened Jul 7, 2026
Request Editor overwrites existing CRLF line endings with LF when run on Linux Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

zaproxy/zaproxy#9375 · 3 comments · Opened Jul 6, 2026
Support PATCH method Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 48/100

zaproxy/zest#370 · 15 comments · Opened Jun 1, 2026
Alert API and tree refresh load alerts from all sessions instead of current session Open

Type-Task

Difficulty 3/5 1-2 days Newbie friendliness 58/100

zaproxy/zaproxy#9346 · 3 comments · 1 reaction · Opened May 28, 2026
Upgrade the version of commons-configuration Open

Type-Task

Difficulty 4/5 3-5 days Newbie friendliness 45/100

zaproxy/zaproxy#9344 · 3 comments · Opened May 26, 2026
Outdated ZAP in Linux distros Open

third-party

Difficulty 3/5 1-2 days Newbie friendliness 48/100

zaproxy/zaproxy#9320 · 14 comments · Opened Apr 30, 2026
Crimson Blazor Decoder Open

marketplace

zaproxy/zaproxy#9311 · 4 comments · 1 assignee · Opened Apr 24, 2026
debian bookworm EOL 10 June 2026 Open

Docker Type-Task

Difficulty 2/5 1-3 hours Newbie friendliness 58/100

zaproxy/zaproxy#9310 · 5 comments · Opened Apr 24, 2026
Passive/active script rules might lose their metadata Open

add-on bug in:scripts

Difficulty 4/5 3-5 days Newbie friendliness 48/100

zaproxy/zaproxy#9297 · 2 comments · Opened Apr 14, 2026
False Positives of "SQL Injection" Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

zaproxy/zaproxy#9289 · 2 comments · Opened Mar 30, 2026
Add MCP (Model Context Protocol) security scan rules Open

add-on enhancement in:mcp

Difficulty 4/5 3-5 days Newbie friendliness 52/100

zaproxy/zaproxy#9288 · 5 comments · Opened Mar 27, 2026
Found some performance issues... Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

zaproxy/zaproxy#9280 · 5 comments · 1 reaction · Opened Mar 11, 2026
Very high CPU during passive scan Open

add-on bug in:pscan

Difficulty 4/5 3-5 days Newbie friendliness 45/100

zaproxy/zaproxy#9278 · 12 comments · 1 reaction · Opened Mar 10, 2026
GUI Unresponsive during spidering Open

add-on bug in:spider

zaproxy/zaproxy#9277 · 1 assignee · Opened Mar 10, 2026
Customizing OpenAPI Import Workflow with LLM-Based Data Generation Open

add-on enhancement in:llm in:openapi

Difficulty 5/5 Over a week Newbie friendliness 25/100

zaproxy/zaproxy#9270 · 2 comments · Opened Mar 3, 2026
Min Java 21 for 2.18.0 Open

tracker

zaproxy/zaproxy#9258 · 1 comment · 1 assignee · Opened Feb 24, 2026
ZAP hangs at the end of Automation Framework plan run Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

zaproxy/zaproxy#9250 · 8 comments · Opened Feb 18, 2026
Unable to Export Out of Scope URLs in Zap Automation Framework Open

add-on enhancement in:exim

Difficulty 4/5 3-5 days Newbie friendliness 45/100

zaproxy/zaproxy#9245 · 5 comments · Opened Feb 13, 2026
AI Analysis Engine Open

marketplace

Difficulty 5/5 Over a week Newbie friendliness 25/100

zaproxy/zaproxy#9233 · 22 comments · Opened Jan 30, 2026
Raising alerts is sometimes slow Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

zaproxy/zaproxy#9229 · 16 comments · Opened Jan 27, 2026
ZAP Scan Baseline Report Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

zaproxy/zaproxy-website#3519 · 19 comments · Opened Jan 12, 2026
Migrate "params" from core to an add-on Open

add-on Maintainability tracker Usability

zaproxy/zaproxy#9210 · 5 comments · 1 assignee · Opened Jan 6, 2026
Broken mobile layout and hidden nav make page difficult to use Open

Difficulty 1/5 Under an hour Newbie friendliness 30/100

zaproxy/zap-api-docs#240 · 1 comment · Opened Dec 26, 2025
Add Collaborative Scan Session Management and Team Results Sharing Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

zaproxy/zaproxy#9198 · 1 comment · Opened Dec 22, 2025
Scrolling Problem in Alerts details panel Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

zaproxy/zaproxy#9189 · 17 comments · Opened Dec 13, 2025
SourceCodeDisclosureFileInclusionScanRule should not mix `4xx` responses with `200` responses when performing analysis Open

add-on bug FalsePositive in:ascanrulesBeta

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

zaproxy/zaproxy#9184 · 13 comments · Opened Dec 10, 2025
CorsScanRule should not treat `4xx` responses as `HIGH` severity Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

zaproxy/zaproxy#9183 · 3 comments · Opened Dec 10, 2025
Remove dependencies on JDOM Open

API Client enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

zaproxy/zaproxy#9182 · 5 comments · 2 reactions · Opened Dec 8, 2025
Uninstall it doesn't work Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

zaproxy/zaproxy#9171 · 3 comments · Opened Dec 4, 2025
Add Passive Scan Rule to detect Information Disclosure in Response Headers Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

zaproxy/zaproxy#9160 · 3 comments · Opened Nov 25, 2025

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

zaproxy

Showing the newest 100

Get new issues in your inbox