ZAP Releases OWASP PenTest Kit Browser Extension for Application Security Testing

OWASP ZAP has released the OWASP PTK add-on v0.2.0 alpha, integrating the PTK browser extension directly into ZAP-launched browsers to streamline application security testing. The add-on enables in-browser DAST, IAST, SAST, SCA, and utilities like JWT and cookie editors, all proxied and recorded by ZAP for re-testing and analysis. It outlines a recommended workflow for authenticated, SPA-heavy environments, emphasizing scoped, conservative active scanning, and highlights seamless pivoting between findings and ZAP tools. Announced January 19, 2026, this release aims to improve efficiency and coverage for pen testers working within browser-native contexts.