Zed Attack Proxy (@zaproxy) | teapawt

Pinned Tweet

Zed Attack Proxy@zaproxy1 Jan 2021

Want to learn more about ZAP? The latest tutorial videos are all linked off zaproxy.org/videos/ - we're adding to them all of the time.

6

97

Zed Attack Proxy@zaproxyOct 13

LLMs have changed how software is developed - read about how we’re handling that change in the ZAP project: zaproxy.org/blog/2026-10-13-… #zaproxy #oss #llm

Developing ZAP in the LLM Age

LLMs have made it much easier to generate code, which changes the balance of how open source projects like ZAP are developed. We are not closing the door on new contributors - ZAP has always been a...

11

703

Zed Attack Proxy@zaproxyOct 8

Initial support for handling OAuth2.0 is now available. Details on the ZAP Blog: zaproxy.org/blog/2026-10-08-… Lots of other add-ons have also been updated, so update ZAP now! #appsec #zaproxy

Initial OAuth2.0 support

The Authentication Helper add-on now ships with an OAuth2 authentication method for the non-interactive grant types: client_credentials and password. This is an early release and we want your...

10

583

Zed Attack Proxy@zaproxyOct 8

Big set of add-on releases this morning #zaproxy #dast #AppSec #WebAppSec

11

674

Zed Attack Proxy@zaproxyOct 1

ZAP Updates for September: The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP's nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag. zaproxy.org/blog/2026-10-01-… #zaproxy #appsec

ZAP Updates - September 2026

The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.

1

10

726

Zed Attack Proxy@zaproxySep 15

The latest weekly release does not include the AJAX Spider and DOM XSS add-ons. You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead. For more details see zaproxy.org/blog/2026-09-08-… #zaproxy #appsec

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

10

587

Zed Attack Proxy@zaproxySep 8

ZAP updates for August. We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications. zaproxy.org/blog/2026-09-08-… #zaproxy #appsec

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

1

8

516

Zed Attack Proxy@zaproxyAug 20

ZAP's Technology Detection add-on got a new icon in today's release.

5

1,052

Zed Attack Proxy@zaproxyAug 7

Introducing ZAP LLM Support: zaproxy.org/blog/2026-08-07-… A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice. #zaproxy #appsec

The ZAP LLM Support Add-on

A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.

17

1,299

Zed Attack Proxy@zaproxyAug 6

zaproxy.org/blog/2026-08-06-… - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider #zaproxy #appsec

ZAP Updates - July 2026

ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.

13

1,373

Zed Attack Proxy@zaproxyJul 31

It has been 3 years since ZAP left @owasp Update your docs! zaproxy.org/docs/nowaspzap/

N⛔WASP ZAP

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP...

16

1,270

Zed Attack Proxy retweeted

Zed Attack Proxy@zaproxyJul 6

Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

10

848

Zed Attack Proxy@zaproxyJul 6

Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

10

848

Zed Attack Proxy@zaproxyJul 1

ZAP Blog: June Updates zaproxy.org/blog/2026-07-01-… More PTK integration, lots of Client Spider improvements, and much more.. #zaproxy #appsec

ZAP Updates - June 2026

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client...

6

1,010

Zed Attack Proxy@zaproxyJun 29

Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. zaproxy.org/blog/2026-06-29-… @pentestkit #zaproxy #owaspptk #appsec

Even More OWASP PTK Integration with ZAP

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control...

5

668

Zed Attack Proxy@zaproxyJun 24

An Insecure Java Deserialization vulnerability has been reported in a ZAP add-on via @neo_ai_engineer Update your ZAP add-ons now, and definitely update from older versions of ZAP. For more details see: zaproxy.org/blog/2026-06-24-…

Java Deserialization Vulnerability in ZAP Viewstate Add-on

A Java Deserialization Vulnerability has been found in the ZAP Viewstate Add-on. Update your ZAP add-ons now, and if you are on an older version of ZAP then update that ASAP.

14

1,259

Zed Attack Proxy@zaproxyJun 5

ZAP now has a dedicated OWASP PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. Check out the dramatic improvement in the scores vs Google Firing Range! zaproxy.org/blog/2026-06-05-… #zaproxy #owaspptk #appsec

Automating OWASP PTK with ZAP (Phase 2)

ZAP now has a dedicated PTK active scan rule, so you can run the PTK rules in the ZAP active scanner. And there are still more changes planned, but the results against Firing Range have been dramatic!

5

2,031

Zed Attack Proxy@zaproxyJun 2

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on. zaproxy.org/blog/2026-06-02-… #zaproxy #appsec

ZAP Updates - May 2026

In May ZAP learned to scan MCP servers as a first-class target, OWASP PTK automation reached Phase 1, and the Params extension moved out of the core into its own add-on.

7

896

Zed Attack Proxy@zaproxyMay 21

ZAP can now scan MCP Servers, in the Desktop, Automation Framework and in a new GitHub Action. Read all about it on the blog: zaproxy.org/blog/2026-05-21-… #zaproxy #appsec #mcp

Scanning MCP Servers with ZAP

ZAP can now scan MCP (Model Context Protocol) servers as a first-class target. Import an MCP server from the ZAP desktop or the Automation Framework, or run the new action-mcp-scan GitHub Action to...

26

1,894

Zed Attack Proxy@zaproxyMay 6

ZAP April report zaproxy.org/blog/2026-05-01-… Nearly 10 Million runs, and over 15,000 GitHub stars! #zaproxy #appsec

ZAP Updates - April 2026

ZAP was started nearly 10 million times in April, and the main zaproxy repo hit 15,000 GitHub stars. Read on for blog post summaries and the full add-on changelog.

7

462

Zed Attack Proxy@zaproxyMay 6

Blog: Automating OWASP PTK with ZAP (Phase 1) You can now automate @OWASP @pentestkit using ZAP zaproxy.org/blog/2026-05-06-… #zaproxy #owasp #appsec

Automating OWASP PTK with ZAP (Phase 1)

ZAP’s Automation Framework can now drive OWASP PTK scans using the Client Spider. This is an early release - we want you to try it and give us feedback while we work toward deeper integration with...

18

3,477