Security scanners
OWASP ZAP
Free, open-source web application security scanner and proxy for testing a running site, including scripted scans.
Pricing as seen
Free and open source.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
Point ZAP at a deployed URL from any of these builders. It is not a plugin inside the builder, and active scans can be noisy. Get permission and use a non-production target first.
What it is
Zed Attack Proxy is the OWASP project for finding vulnerabilities in web apps. You run it yourself. It can intercept traffic, spider a site, and run active scans. The project also documents automation for CI.
It is a general-purpose DAST tool, not a vibe-coding product. There is no hosted “paste a Lovable URL” flow. You install it, point it at a target you are allowed to test, and read the alerts.
Best for: Someone who can run a local or CI scanner and wants an industry-standard DAST tool with no license fee.
Watch-outs
- You operate it. There is no vendor watching the scan for you.
- Active scans send attack traffic. Do not point that at a system you do not own.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
The right tool when you want a scanner you control and you are willing to learn it. It is the wrong first click if you wanted a two-minute hosted report. Active scanning against production without a plan can break things or trip alarms.