OWASP ZAP explained: what it scans and the 10 usual findings

OWASP ZAP is a free, open-source scanner that looks at a website the way an attacker's first tool would. It browses the site, reads every response and reports what looks wrong: a missing security header, a cookie without a flag, a form without a token. This is an explainer of the tool; what Kasandro's own baseline scans showed is in the post on our checks.

OWASP ZAP in one paragraph

ZAP (Zed Attack Proxy) is described by its project site as free and open source and "the world's most widely used web app scanner". It sits between a browser and a site as a proxy, or crawls the site by itself, and raises alerts, each with an ID and a name from its public alert reference. Its site carries the mark "ZAP by Checkmarx" and also calls ZAP an independent open-source project. You can run it from a desktop app, from Docker, or as a step in CI.

Baseline scan versus active scan

The baseline scan is the light one. According to its documentation it runs the spider for one minute by default, waits for the passive scan to finish and reports. It "doesn't perform any actual attacks": it only reads the responses the site gives anyway, so it is safe to run on a site you own, takes a few minutes and fits in a pipeline. By default every alert is a warning; a rules file can turn a rule into IGNORE, INFO or FAIL.

An active scan does send attack-like requests (for example SQL injection or reflected cross-site scripting payloads). It can change data, so it belongs on a test copy and only on a system you are allowed to test.

The 10 findings you will see most

These ten are the alerts ordinary sites most often get from a baseline scan. IDs and names are from ZAP's alert reference.

1. Content Security Policy (CSP) Header Not Set (10038). The site does not tell the browser which scripts and images it may load, so an injected script has an easier life. Fix: send a Content-Security-Policy header that lists the sources you really use.
2. Missing Anti-clickjacking Header (10020). Another site could put yours in a hidden frame and trick a click. Fix: frame-ancestors in the CSP or X-Frame-Options.
3. X-Content-Type-Options Header Missing (10021). The browser may guess a file's type and run something that was meant as text. Fix: X-Content-Type-Options: nosniff.
4. Strict-Transport-Security Header Not Set (10035). A first visit over plain HTTP can be intercepted. Fix: send Strict-Transport-Security on HTTPS responses.
5. Cookie No HttpOnly Flag (10010). A script on the page can read the cookie. Fix: set HttpOnly on session cookies.
6. Cookie without SameSite Attribute (10054). The cookie travels on cross-site requests. Fix: set SameSite to Lax or Strict where the flow allows.
7. Server Leaks Version Information via "Server" HTTP Response Header Field (10036). The exact software version helps someone pick a known exploit. Fix: do not send the version.
8. Cross-Domain Misconfiguration (10098). The site allows other origins to read its responses more widely than needed. Fix: name the origins you trust, not a wildcard.
9. Absence of Anti-CSRF Tokens (10202). A form can be submitted by another site on a logged-in user's behalf. Fix: a per-form token or a strict cookie policy plus origin checks.
10. Vulnerable JS Library (10003). A bundled library has a known vulnerability. Fix: update it; a dependency audit in CI catches it earlier.

Two more you meet in an active scan: SQL Injection (40018) and Cross Site Scripting (Reflected) (40012).

What a clean scan does not prove

A baseline scan reads responses; it does not log in, does not understand your money logic and does not look for a broken access rule between two users. A clean result means "no known header or cookie mistake on the pages the spider reached". It is a floor, not a certificate, and it does not replace a review of the code or a penetration test by a person.

Where this stands in the veinito group

ClassKasa, a sister product in the veinito group, has an OWASP ZAP baseline job in its CI pipeline, and since 13 October 2026 Kasandro runs the same baseline scan on every code change: new findings stop the build. The first run, 63 checks passed and 0 failed, is described in our post on the checks.

FAQ

Is OWASP ZAP free?

Yes. Its project site describes it as free and open source.

Is a ZAP baseline scan safe to run on my own site?

Its documentation says the baseline scan does not perform attacks; it spiders and analyses responses passively. Run it on systems you own or may test.

Does a clean ZAP scan mean a site is secure?

No. It means ZAP found none of its known header, cookie or library problems on the pages it reached. Logic and access mistakes need a human review.

Has Kasandro been scanned with ZAP?

Yes: the baseline scan runs on every code change since 13 October 2026, and new findings stop the build. The first run is described in our post on the checks.