{
 "slug": "zap",
 "name": "ZAP",
 "tagline": "DAST scanner for web applications and APIs",
 "category": "security-identity",
 "use_cases": [
  "dast",
  "web-security-testing",
  "api-scanning"
 ],
 "aliases": [
  "zed attack proxy"
 ],
 "status": "live",
 "upstream": {
  "vendor": "ZAP Development Team",
  "url": "https://www.zaproxy.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/zaproxy/zaproxy/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "not_offered"
  },
  "azure": {
   "status": "live",
   "version": "2.17.0",
   "last_build": "2026-08-12",
   "offer_id": "zap",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:zap:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.zap?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/zap/",
  "json": "https://lynxroute.com/products/zap/product.json"
 },
 "release_notes": [],
 "release_history": [
  {
   "version": "2.17.0",
   "azure": "2026-08-12"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer zap --plan payg-gen2\naz vm create -g my-rg -n zap --size Standard_D2s_v3 \\\n  --image lynxroute:zap:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "ZAP (Zed Attack Proxy) is the most widely used open-source dynamic application security testing scanner. It finds vulnerabilities in a running web application or API the way an attacker would - by sending real requests and analysing the responses - rather than by reading source code. A spider maps the application, passive rules inspect every response as it passes, and active rules probe for injection, cross-site scripting, broken access control, insecure deserialisation, path traversal and misconfiguration. ZAP imports OpenAPI, SOAP and GraphQL definitions to scan APIs that have no browsable UI, scores findings by confidence and risk, and exports HTML, JSON, XML or Markdown reports. Everything it does is driven by a documented REST API, which is what makes it the standard choice for automated security testing inside a build pipeline.",
  "image_adds": "Security hardening:\n- Per-instance API key - generated at first boot, never baked into the image; every scanner view and action requires it\n- Scanner bound to loopback - the daemon listens on 127.0.0.1 only; nginx terminates TLS on 443 and is the sole path in\n- Not usable as an open proxy - ZAP doubles as an intercepting proxy, so the reverse-proxy configuration pins the upstream host and the appliance refuses to relay traffic to third-party sites\n- No outbound calls on first boot - scan rules are baked into the image and usage telemetry is switched off; the VM works in an egress-restricted subnet\n- CVE scan - every image is scanned for vulnerabilities with Trivy before release, and the bundled Java components are additionally checked against the OSV advisory database\n- UFW firewall - only 22 and 443 open; the scanner port is never externally reachable\n- fail2ban - SSH brute-force protection\n- AppArmor - mandatory access control\nOS hardening (CIS Level 1):\n- CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown\n- auditd - system call auditing for critical paths\n- SSH hardening - PasswordAuthentication disabled, key-only access\n- Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR\n- /tmp as tmpfs - nosuid, nodev, noexec\n- Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)\nCompliance artifacts (inside the VM):\n- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n- CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html\n- Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n- Scan reports - HTML, JSON, XML and Markdown, generated on demand through the API"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}