ZAP (Zed Attack Proxy) is an open-source web app security scanner. It offers alerts, modes, add-on marketplace, authentication, passive scan, scope, API, and other features.