Contributing Guide on ZAP

Contribute: Coding

Mon, 01 Jan 0001 00:00:00 +0000

There’s always lots of coding to be done!

This can be one of the most rewarding ways to contribute to ZAP - just look at the ZAP Student Hall of Fame to see how many students have made major contributions to ZAP and where it’s led them.

You don’t have to be a student of course, anyone who know is interested will be able to help us out with the ZAP code base.

Contribute: Core Team

Mon, 01 Jan 0001 00:00:00 +0000

The Core Team is the set of people who have made the most significant contributions to the most recent ZAP releases. It is also a team - we work together in a collaborative way to make ZAP a better project as per the Mission Statement.

Decisions are made as a group, no one person makes the final decision - either we all agree or we work out a way to ensure everyone is happy with a given approach.

Contribute: Documentation

Mon, 01 Jan 0001 00:00:00 +0000

Documentation is very important, and while we have tried to make the ZAP documentation as useful as possible we know that it still needs to be improved.

The latest ZAP docs are now all available on this site but the source of those pages does vary.

Website Pages

The source for the main website pages is under https://github.com/zaproxy/zaproxy-website/tree/main/site/content

Contribute: Forums

Mon, 01 Jan 0001 00:00:00 +0000

Join the discussions - and remember you don’t have to be a ZAP ’expert’ in order to answer questions about ZAP.

Contribute: Issues

Mon, 01 Jan 0001 00:00:00 +0000

If you are having problems with ZAP then it is always best to first look at the FAQ: Somethings not working. What should I do?.

In particular:

Check the Frequently Asked Questions
Search the ZAP User Group posts
Search the existing issues

Raising an Issue

If you have found a new bug then raise a new issue.

Contribute: Run a ZAP Hackathon

Mon, 01 Jan 0001 00:00:00 +0000

If you run a technical group like an OWASP Local Chapter then how about running a ZAP Hackathon?

You can do it all on your own but if you reach out to the ZAP Team (either directly or via the User Group) then we will be delighted to help you as much as we can.

Contribute: Scan Rules

Mon, 01 Jan 0001 00:00:00 +0000

Scan rules are a good place to start contributing as they are relatively self contained and do not require you to understand the rest of the ZAP code base. They are also a great way to learn more about security.

Finding Something to Improve

If you already know of a vulnerability that ZAP doesn’t find, or a False Positive that ZAP reports (for example as you have run ZAP against one of your own apps) then you can skip this part.

Contribute: Social Media

Mon, 01 Jan 0001 00:00:00 +0000

Liking, following or staring ZAP resources really helps raise ZAP’s profile - what could be an easier way to contribute?

We also love seeing articles about ZAP on other sites, just don’t forget to tell us about them!

Contribute: Test ZAP

Mon, 01 Jan 0001 00:00:00 +0000

ZAP is designed to attack real world apps, so we do not tune ZAP just to score better against vulnerable test apps. However, such test apps are still very worthwhile and can be representative of real world apps.

There are a large number of deliberately vulnerable apps - see the OWASP VWAD project.

Contribute: Translations

Mon, 01 Jan 0001 00:00:00 +0000

We believe that security tools should be available to everyone, which is why ZAP is one of the very few security tools that is both fully internationalised and translated into many languages.

ZAP Desktop

You can help translate the ZAP Desktop via the Crowdin: ZAPROXY project.

Roles and Governance

Mon, 01 Jan 0001 00:00:00 +0000

ZAP’s governance model is simple.

There are two roles: general contributors, and the Core Team.

Decisions within the project are made based on majority rules. That is to say, if someone puts forth a new idea or decision to be made, it is made based on the majority of the team agreeing on the direction/outcome.