Scan Policies on ZAP

API Policy

Mon, 01 Jan 0001 00:00:00 +0000

API Policy

A policy focusing on issues likely to impact APIs and not UI.

For the list of scan rules included see the Alert Tag: POLICY_API page.

Programmatic Name: API

Return to main scan policies page.

Default Policy

Mon, 01 Jan 0001 00:00:00 +0000

Default Policy

A policy which enables all of the installed active scan rules.

Programmatic Name: Default Policy

Return to main scan policies page.

Developer CI/CD Policy

Mon, 01 Jan 0001 00:00:00 +0000

Developer CI/CD Policy

This policy is designed to be used by developers in a CI/CD pipeline.

Recommended for running in CI/CD
No environmental / server related rules
No long running rules
No rules with high false positives
No timing attacks
No informational only rules
Minimal overlap

For the list of scan rules included see the Alert Tag: POLICY_DEV_CICD page.

Developer Standard Policy

Mon, 01 Jan 0001 00:00:00 +0000

Developer Standard Policy

A developer focused policy meant to perform fairly quickly while providing a greater set of results than the CICD policy, intended for use in a dev environment.

A superset of Developer CICD
Intended to run in a dev environment
No environmental / server related rules
No rules with high false positives
No timing attacks
No informational only rules
Can include longer running rules

For the list of scan rules included see the Alert Tag: POLICY_DEV_STD page.

Developer Full Policy

Mon, 01 Jan 0001 00:00:00 +0000

Developer Full Policy

A developer focused policy, including a superset of the dev standard with a greater variety of potential findings and only minimal environmental/server related rules, intended for use in a dev environment.

A superset of Developer Standard
Intended to run in a dev environment
No rules with high false positives
No timing attacks
Minimal environmental / server related rules

For the list of scan rules included see the Alert Tag: POLICY_DEV_FULL page.

QA CI/CD Policy

Mon, 01 Jan 0001 00:00:00 +0000

QA CI/CD Policy

A quality assurance focused policy meant to perform fairly quickly while providing a greater set of results than developer policies, intended for use in a CI/CD pipeline for a QA/staging environment.

Recommended for running in CI/CD
Intended to run in a QA / Staging environment which is close to production
A superset of Developer CI/CD but with important env / server rules enabled
No long running rules
No rules with high false positives
No timing attacks
No informational only rules
Minimal overlap

For the list of scan rules included see the Alert Tag: POLICY_QA_CICD page.

QA Standard Policy

Mon, 01 Jan 0001 00:00:00 +0000

QA Standard Policy

A quality assurance focused policy meant to perform fairly quickly while providing a greater set of results than developer policies, intended for use in a QA/staging environment.

Intended to run in a QA / Staging environment which is close to production
A superset of Developer Standard but with important env / server rules enabled
Not env issues that should have been fixed by everyone

For the list of scan rules included see the Alert Tag: POLICY_QA_STD page.

QA Full Policy

Mon, 01 Jan 0001 00:00:00 +0000

QA Full Policy

A quality assurance focused policy, including a superset of the QA standard with a greater variety of potential findings with more environmental/server related rules, intended for use in a QA/Staging environment.

Intended to run in a QA / Staging environment which is close to production
A superset of Developer Full (and QA Standard) but with more env / server rules enabled

For the list of scan rules included see the Alert Tag: POLICY_QA_FULL page.

Penetration Tester Policy

Mon, 01 Jan 0001 00:00:00 +0000

Penetration Tester Policy

A policy which enables all of the installed active scan rules with the exception of the Example rules.

Programmatic Name: Pen Test

Return to main scan policies page.