# Is the "Official OWASP ZAP" Jenkins plugin still maintained? Why does the repo say it's no longer an official ZAP project? **URL:** \ **Category:** Ask a question\ **Tags:** question\ **Created:** [September 24, 2026, 4:31am UTC](https://community.jenkins.io/t/is-the-official-owasp-zap-jenkins-plugin-still-maintained-why-does-the-repo-say-its-no-longer-an-official-zap-project/37300 "2026-09-24T04:31:01Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![utaber](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/utaber/32/23019_2.png) [@utaber](https://community.jenkins.io/u/utaber)\ **Post date:** [September 24, 2026, 4:31am UTC](https://community.jenkins.io/t/is-the-official-owasp-zap-jenkins-plugin-still-maintained-why-does-the-repo-say-its-no-longer-an-official-zap-project/37300/1 "2026-09-24T04:31:01Z")
I was trying to integrate DAST on my CI/CD lab and stumble across Official OWASP ZAP plugin on Jenkins available plugin tab and notices that the latest update was over 9 years ago. I did some research on the cause of it by going through their GitHub repo, searching around their website for some clue, and found nothing. The only thing that resembles of a hint is the latest commit message saying “Its no longer an official ZAP project” hinting at a possible abandonment, but why? Is there a real concrete reason on why they abandoned it? note: also, I’m still new in this community, so if I were to somehow break a guideline, I’m sorry in advance! thanks ---
**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\ **Post date:** [September 24, 2026, 11:38am UTC](https://community.jenkins.io/t/is-the-official-owasp-zap-jenkins-plugin-still-maintained-why-does-the-repo-say-its-no-longer-an-official-zap-project/37300/2 "2026-09-24T11:38:21Z")
> [@utaber](#): > > The only thing that resembles of a hint is the latest commit message saying “Its no longer an official ZAP project” hinting at a possible abandonment, but why? > Is there a real concrete reason on why they abandoned it? I suspect that they want users to run their recommended containerized environment instead of using a Jenkins plugin. Their documentation at “[Automate Zap](https://www.zaproxy.org/docs/automate/)” includes: - [Command line](https://www.zaproxy.org/docs/desktop/addons/quick-start/cmdline/) - [Docker packaged scans](https://www.zaproxy.org/docs/docker/) The [mailing list description](https://groups.google.com/g/zaproxy-jenkins) says: > **Note that this plugin is no longer supported by the ZAP Core Team, however you can use the ZAP [Docker images](https://www.zaproxy.org/docs/docker/) in any CI/CD pipeline.** ## Why you should not use the [Zap plugin](https://plugins.jenkins.io/zap/) The plugin has a security vulnerability and bugs that will prevent it from working correctly in Jenkins versions released in the last 5 years. The [unresolved security vulnerability](https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1041) reports that the plugins stores a credential in plain text. The Jenkins [plugin health score](https://plugins.jenkins.io/zap/healthscore/) is 46%. Most actively used Jenkins plugins have scores 80% or higher. The [Jenkins issue tracker](https://issues.jenkins.io/issues/?jql=resolution%20is%20EMPTY%20and%20component%3D21935) includes the following known issues: - Plugin fails when configuring job with Jenkins 2.277.1 or later - [JENKINS-65399](https://issues.jenkins.io/browse/JENKINS-65399) - Adding a build step has the wrong behavior since 2.263.4 - [JENKINS-68393](https://issues.jenkins.io/browse/JENKINS-68393) - Plugin fails when content security policy checking is enabled [JENKINS-74265](https://issues.jenkins.io/browse/JENKINS-74265) ---
**Author:** ![utaber](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/utaber/32/23019_2.png) [@utaber](https://community.jenkins.io/u/utaber)\ **Post date:** [September 25, 2026, 3:17am UTC](https://community.jenkins.io/t/is-the-official-owasp-zap-jenkins-plugin-still-maintained-why-does-the-repo-say-its-no-longer-an-official-zap-project/37300/3 "2026-09-25T03:17:49Z")
I see. It’s just that it’s a bit abrupt to discontinued it, seeing their other plugin project like dependency track is still maintained. But I really want to know the actual reason for the abandonment, like is it because of “favoring flexibility” over “ease of use”? perhaps it’s not worth the hassle to maintain it? I guess we will never truly know until one of the people behind it gave a valid answer. Regardless, thanks for the answer, Mark Will use the containerized automation instead of the plugins!