ZAP
ZAP is a desktop web application security testing tool for intercepting traffic, exploring sites, and finding common vulnerabilities during development and assessment.
What is ZAP?
ZAP is a desktop security and privacy tool for testing web applications. It helps developers, testers, and security teams inspect HTTP and HTTPS traffic, crawl sites, replay requests, and identify common web security issues during development or assessment work. The app includes an intercepting proxy, automated and manual testing tools, session handling, reporting, and an extensible add-on model for specialized workflows. On macOS, it runs as a standard app and can also be started from the command line for scripted or headless use. ZAP is published through the ZAP project and is widely used in application security workflows for local testing, learning, and continuous security checks.
Key features
- Intercept and inspect web traffic between a browser and a target application
- Spider and explore sites to discover pages, endpoints, and parameters
- Run automated scans to detect common web application vulnerabilities
- Replay, edit, and resend requests for manual testing and troubleshooting
- Generate reports and review findings from testing sessions
- Extend the tool with add-ons for specialized scanning and testing tasks
Review app leftovers with diCleaner
Inspect caches, support files, containers, and login items before cleaning.
Safety overview
Status: Use with caution
ZAP is legitimate security testing software, but it is designed to intercept and modify web traffic and can actively probe sites for weaknesses. That access is normal for its purpose, yet it also means scans or proxying can affect test environments, generate heavy traffic, or expose sensitive session data inside the app if you use it on real accounts. On macOS, you may also see a warning that the app is from an unverified developer when opening it. Use it only for systems you own or are authorized to test, and avoid loading personal or production accounts unless that is part of your approved work.
Recommendation: Keep ZAP if you use it for web security testing, secure development, or learning application security. If you do not use penetration testing tools, you can remove it like any other app. Before running active scans, point it at approved targets and use a separate test account when possible.
Common paths
/Applications/ZAP.app
Share your experience
Be the first to share your experience.