anubissbe/Auto-ZAP Security Scanner

Zero-config OWASP ZAP security scanner. Auto-detects 30+ frameworks, databases, and auth.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Feb 19, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: anubissbe/auto-zap@7dc600af70ea11b308bf45a980668925b2da12db # v1.6.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
url	Target URL to scan (skips auto-detection if provided)	no	""
port	Override the detected application port	no	""
report-path	Custom path for the HTML report (default: zap-report-<timestamp>.html)	no	""
full-scan	Run a thorough active scan (slower, 60 min timeout)	no	false
keep-docker	Do not stop Docker containers after the scan	no	false
skip-install	Skip dependency installation	no	false
auth-user	Username for authenticated scanning	no	""
auth-password	Password for authenticated scanning	no	""
auth-url	Login endpoint URL (auto-detected if not provided)	no	""
auth-token	Pre-obtained Bearer token (skips login flow)	no	""
auth-type	Authentication type: form, json, or bearer	no	""
auto-auth	Automatically detect auth, create a temp user, and run an authenticated scan	no	false
scan-mode	Scan mode: auto (default), webapp, api, or static	no	auto
verbose	Enable verbose debug logging	no	false
dry-run	Show what would happen without executing any scan	no	false
use-docker-zap	Force ZAP to run in Docker mode instead of local Java	no	false
working-directory	Working directory for the scan (default: repository root)	no	.

Outputs

name	description
report-path	Path to the generated HTML report
json-path	Path to the generated JSON report
sarif-path	Path to the generated SARIF report
high-count	Number of HIGH severity vulnerabilities
medium-count	Number of MEDIUM severity vulnerabilities
low-count	Number of LOW severity vulnerabilities