SE Radio 568: Simon Bennetts on OWASP Dynamic Application Security Testing Tool ZAP

Open Source Challenges

Maintaining an open source project like ZAP comes with its own set of challenges, particularly in terms of resource allocation and community involvement. Simon Bennetts shares that while ZAP has a small core team, the tool's success heavily relies on contributions from the broader community 1. Funding remains a significant hurdle, as Bennetts notes the difficulty in securing financial support to sustain ongoing development efforts 2. He emphasizes the need for more companies to sponsor work on ZAP, similar to how Jit supports his efforts 1.

Raising money has never been one of our strengths, I'm afraid.

--- Simon Bennetts

Despite these challenges, ZAP's status as a flagship project of OWASP highlights its importance and widespread use in the industry.

   

Community Contributions

Community contributions are vital to the growth and adaptation of ZAP, allowing it to remain competitive with commercial tools. Simon Bennetts explains that ZAP's open-source nature and community-based approach enable anyone to get involved, which is a key differentiator from other tools 3. The project encourages contributions beyond coding, including documentation and testing, making it accessible to a wide range of contributors 4.

We want people to get involved and we'll be very happy to help you.

--- Simon Bennetts

Bennetts also highlights the importance of scripting capabilities, which allow users to customize ZAP to meet specific needs, further enhancing its utility and appeal.