OWASP ZAP Baseline Security Scan

Run a ZAP baseline security scan against the local application.

Workflow

Check prerequisites:

• Verify Docker is installed and running: docker info

• Check if scripts/zap-baseline.sh exists in the project

Execute scan:

• If the script exists, run: bash scripts/zap-baseline.sh

• If the script does not exist, inform the user that this project does not have a ZAP baseline scan configured

Analyze results:

• After the scan completes, read zap-report.html (or zap-report.md for text)

• Summarize findings:

• Total number of alerts by risk level (High, Medium, Low, Informational)

• List each Medium+ finding with its rule ID, name, and recommended fix

• Categorize findings as "infrastructure-level" (fix at CDN/proxy) vs "application-level" (fix in code)

Handle failures:

• If the scan failed, explain what failed and suggest concrete remediation steps

Execution

Run the scan now.