OWASP ZAP Baseline Security Scan
Run a ZAP baseline security scan against the local application.
Workflow
- Check prerequisites:
- Verify Docker is installed and running: docker info - Check if scripts/zap-baseline.sh exists in the project
- Execute scan:
- If the script exists, run: bash scripts/zap-baseline.sh - If the script does not exist, inform the user that this project does not have a ZAP baseline scan configured
- Analyze results:
- After the scan completes, read zap-report.html (or zap-report.md for text) - Summarize findings: - Total number of alerts by risk level (High, Medium, Low, Informational) - List each Medium+ finding with its rule ID, name, and recommended fix - Categorize findings as "infrastructure-level" (fix at CDN/proxy) vs "application-level" (fix in code)
- Handle failures:
- If the scan failed, explain what failed and suggest concrete remediation steps
Execution
Run the scan now.