Vibe Coding Security Fixes ZAP now has a “Generate Fix Prompt” option that copies everything an LLM needs to fix a vulnerability straight to your clipboard. Also: ZAP was run 9.5 million times in March. Vibe coding, anyone?

Blog: Vibe coding security fixes.
www.zaproxy.org/blog/2026-04...
Learn how ZAP can help you make your vibe coded projects more secure.
#zaproxy #vibecoding #appsec

Guest Blog: www.zaproxy.org/blog/2026-04...
Learn how to integrate ZAP with KRO in a Kubernetes cluster to scan the security of each new deployment.
℅ Trevor Mountney
#zaproxy #kubernetes #appsec

ZAP Updates - March 2026 ZAP was started nearly 9.5 million times in March, published integrations with 3 other open source projects, and released the first of many AI related features.

Blog: ZAP Updates for March:
www.zaproxy.org/blog/2026-04...
ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects
#zaproxy #appsec

This is huge!
www.zaproxy.org/blog/2026-04...
OWASP PTK massively increases ZAP’s browser side testing capabilities .. and automation is up next!
Many thanks to Denis Podgurskii for this great integration.
#zaproxy #owasp #appsec

Introducing DeepViolet Introducing DeepViolet: The Engine Behind ZAP’s New TLS Analysis

New ZAP Blog Post: Introducing DeepViolet: The Engine Behind ZAP’s New TLS Analysis
www.zaproxy.org/blog/2026-03...
Thanks to Milton Smith
#zaproxy #deepviolet #appsec

ZAP Updates - February 2026 February was another busy month for the ZAP project, with improvements across browser automation, GraphQL and the Encode/Decode/Hash add-on.

New blog post: ZAP Updates - February 2026
www.zaproxy.org/blog/2026-03...
#zaproxy #appsec

Using ZAP's Encode/Decode/Hash Add-on with CyberChef via Encode/Decode Scripts Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.
www.zaproxy.org/blog/2026-02...
#zaproxy #appsec #cyberchef

Detecting Circular Type References in GraphQL Schemas ZAP can now detect cycles in GraphQL schemas that could lead to denial of service attacks.

New Blog Post: Detecting Circular Type References in GraphQL Schemas
www.zaproxy.org/blog/2026-02...
#zaproxy #appsec #graphql

ZAP Updates - 2025 Highlights and Plans for 2026 Highlights of 2025 and our initial plans for 2026, including more 3rd Party tool integrations, enhanced exploring and, yes, AI integration!

New blog post: www.zaproxy.org/blog/2026-02...
Highlights of 2025 and our initial plans for 2026, including more 3rd Party tool integrations, enhanced exploring and, yes, AI integration!
#zaproxy #appsec #ai

We have made a good start on #AI integration in @zaproxy.org
We know some of you will be very anti-AI, so this will be optional and opt-in.
We have lots of plans, but feedback also appreciated - what integrations would you really like to see .. or not see?

www.zaproxy.org/blog/2026-01...
#zaproxy #owasp #appsec

New “Getting Further with ZAP Scripting” pages: www.zaproxy.org/docs/getting...
Looking for something more? Let @psiinon.bsky.social know!

Dear Open Source contributors: If your AI spent X mins on "enhancement" or "refactorings" but the project maintainer needs >X mins to fix guideline violations and broken code, you didn’t contribute—you drained time and motivation from Open Source maintainers.

infosec.exchange/@bkimminich/...

ZAP 2.17.0 ZAP 2.17.0 has just been released. The release includes core performance improvements and will significantly reduce the number of “duplicate” alerts reported.

ZAP 2.17.0 is now available!
It includes performance improvements, a significant reduction in “duplicate” alerts reported, and new Insights which give you key information about scans.
www.zaproxy.org/blog/2025-12...
#zaproxy #appsec

React2Shell Detection with ZAP React2Shell is the latest big “named” vulnerability - heres how you can detect it with ZAP.

New blog post: #React2Shell Detection with ZAP
www.zaproxy.org/blog/2025-12...
#zaproxy #appsec

The latest version of the retirejs add-on includes a test for CVE-2025-66478 which is marked as "critical" so update now to detect this vulnerability.

ZAP Updates - November 2025 2.17.0 is coming soon, along with Insights and fixes for some issues that caused ZAP to log 50 million errors in one day!

ZAP Updates for November 2025:
www.zaproxy.org/blog/2025-12...
2.17.0 is coming soon, along with Insights and fixes for some issues that caused ZAP to log 50 million errors in one day!
#zaproxy #appsec

New ZAP blog post - read how Telmon Maluleka is enhancing ZAP with AI for Bug Bounty Hunting
www.zaproxy.org/blog/2025-11...

ZAP logged 50 MILLION errors yesterday 😮 Read the blog for more details!
www.zaproxy.org/blog/2025-11...
#zaproxy #appsec

Release w2025-11-24 · zaproxy/zaproxy File Checksum (SHA-256) ZAP_WEEKLY_D-2025-11-24.zip 6a0bab4207bdd498c24fd0edc6eddfa0789cf80510a8290ba3481d573458ccf2

Today’s weekly is the 2.17 Release Candidate! github.com/zaproxy/zapr...
Feedback appreciated

The ZAP services may well be unavailable due to the ongoing Cloudflare problems.
See www.cloudflarestatus.com for more information.

ZAP Updates - October 2025 Systemic alerts, check for updates bug, auth improvements, project pulse, etc See what the ZAP team has been up to.

ZAP Updates for October:
www.zaproxy.org/blog/2025-11...
#zaproxy #appsec

We have just published a new ZAP weekly release, to fix a bug which could cause invalid JSON reports to be generated. If you are using the most recent weekly we recommend you update ASAP.

Sorry, we messed up!
A new scan rule triggered the ZAP Check for Updates call even if you used the "silent" mode.
For more details see www.zaproxy.org/blog/2025-10...

ZAP Updates - September 2025 Configuring scan policies with alert tags, WAVSEP adoption, alert de-duplication and a new add-on publishing guide.

ZAP updates for September:
www.zaproxy.org/blog/2025-10...
#zaproxy #appsec

Alert De-Duplication How and why we will be reporting fewer “duplicate” alerts in ZAP.

New blog post: Alert De-Duplification
www.zaproxy.org/blog/2025-09...
#zaproxy #appsec

🎥 Want to level up your ZAP game?
The @zaproxy.org team has an awesome library of how-tos, demos, and deep dives — all free.

From beginner basics to advanced scripting, it’s all here:
👉 zaproxy.org/videos/

#YouDontKnowZAP

ZAP is Adopting WAVSEP The ZAP team has forked and will maintain WAVSEP going forwards. This blog post explains why.

The ZAP team has forked and will maintain WAVSEP going forwards. This blog post explains why.

www.zaproxy.org/blog/2025-09...

#zaproxy #appsec #wavsep

Configuring Scan Policies with Alert Tags A new feature in ZAP’s automation framework allows you to configure scan policies using alert tags, making it easier to target specific types of vulnerabilities without manually managing individual sc...

You can now configure ZAP Scan Policies using Alert Tags:
www.zaproxy.org/blog/2025-09...
#zaproxy #appsec

ZAP Updates - August 2025 Microsoft Online Login Support, forking wavsep and much, much more!

ZAP Updates - August 2025:
www.zaproxy.org/blog/2025-09...

Microsoft Online Login Support, forking wavsep and much, much more!
#zaproxy #appsec