OWASP ZAP CLI

zap-cli quick-scan --self-contained <url>

Runs a quick web application scan with OWASP ZAP from the CLI, detecting runtime vulnerabilities.

Run it in the CI/CD pipeline when you want dynamic analysis of the application: zap-cli quick-scan launches ZAP's scan against the URL (the crawl and active scan with the rules) and reports findings — runtime vulnerabilities: injection, XSS, missing headers, exposure. It's the reference open-source DAST: scanning the deployed app (the staging environment) in the pipeline. In DevSecOps, ZAP's DAST complements SAST: the code fixed by static analysis, the app validated at runtime by dynamic analysis — scanning the staging environment before deployment.

Don't use it without the app deployed: DAST scans the app at runtime — the staging environment with the app is the requirement; and the active scan generates real traffic (noise and risk of breaking the app) — staging, not production. The quick-scan is a basic scan: full coverage (authenticated scan, fuzzing) requires ZAP configuration (session, API). And watch out: DAST detects what the scan reaches — non-crawlable paths (app with auth) require configuration; false positives are triaged. DAST complements SAST, it doesn't replace it.