zap

OWASP ZAP: free open-source web application scanner and intercepting proxy. Use for automated DAST scanning in CI/CD pipelines, API security testing (OpenAPI/GraphQL/SOAP), passive/active vulnerability scanning, and headless scanning with Docker. Best free alternative to Burp Suite Pro for automated workflows.