zap

Scan web applications dynamically with OWASP ZAP

zaproxy/zaproxy · API & Dynamic Testing (DAST) · scanned v2.17.0 (released 2025-12-15) · commit 8a1bff313f4d · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. An OSV-Scanner confirmation now requires the same ecosystem, package, and version as the Grype match, not only the same advisory and package name (about 30 matches in the first 2026-11-02 run were confirmed by a different version); the list of advisories only OSV-Scanner reports is no longer cut at 100 per project. Advisories govulncheck finds in a release binary without a matching declared dependency (about 700 rows, mostly the Go standard library) now get advisory pages, CSV rows, and KEV and EPSS data, and count toward shipped advisories. Release verification reports build provenance, signature and signer, and release immutability separately; a release that is only immutable is no longer labelled verified (7 projects in the first 2026-11-02 run). Projects that left the catalog are excluded from current totals. The 2026-11-02 week was re-run with all of these changes; the first run is kept under runs/superseded/. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

no change.

Known vulnerabilities

No known advisories matched the declared dependencies.

Second opinion: OSV-Scanner

OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Release integrity

Verdict: no checksums or signatures for ZAP_2.17.0_Linux.tar.gz. The download matches GitHub's recorded digest.

• Build provenance (how and from which source the file was built): none published
• Signature: none
• Immutable release (the file has not changed since it was published; says nothing about how it was built): no

Published with the release:

• Checksums file: no
• Signatures: no
• SLSA provenance: no
• SBOM published with the release: no

Verified means build provenance, or a signature from one of zaproxy/zaproxy's own GitHub Actions workflows, was checked. A release that is only immutable is reported as immutable release only, and a valid signature from any other identity as signed.

Repository security (OpenSSF Scorecard)

Score 6.8/10, assessed 2026-10-19 (OpenSSF public dataset). Scorecard viewer

GitHub Actions workflow audit (zizmor)

54 potential issues in 19 workflow files at this release: 36 high, 18 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

Dependencies (18)

By ecosystem: github 18.

Licenses (as declared in the SBOM): unknown 18.

History

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02-run41380955266-1, folder supply-chain-shard-*/zaproxy__zaproxy/.

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fzaproxy%2Fzaproxy%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/zaproxy/zaproxy/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.