OWASP ZAP
zaproxy.orgSecurity
The free, battle-tested way to actively attack your own web app for XSS and injection flaws before someone else does.
Other products from Security
Catches vulnerable dependencies, container images, and IaC misconfigs right in your IDE and CI, before they hit production.
Open-source static analysis with rules that read like code, so you catch real security bugs at PR time instead of in prod.
Scans every commit for leaked API keys and credentials so a secret buried in git history doesn't become tomorrow's breach.