ZAP baseline

zap-baseline.py -t <url>

Runs the OWASP ZAP baseline scan against the application, detecting passive findings (headers, configurations) without active scanning.

Run it in the CI/CD pipeline when you want passive dynamic analysis: zap-baseline (the ZAP docker script) crawls the app and reports passive findings — missing security headers (HSTS, CSP, X-Frame-Options), cookies without flags, exposed information, versions. It's low-risk DAST: no active scanning (no payload injection), safe for the pipeline and test environment. In DevSecOps, the baseline is the daily (or per-deploy) scan of apps: configuration findings and regressions — the header that disappears in a deploy.

Don't use it as a complete analysis: the baseline is passive — active vulnerabilities (injection, XSS) require active scan (011) or manual; the baseline covers configuration and exposure. And watch out: the baseline requires the app accessible and the test environment; header findings generate noise in legacy apps (those that never had them) — the baseline is calibrated with known false positives. Passive DAST complements SAST: deploy configuration validated, code by static.