Try our new research platform with insights from 80,000+ expert users

GitLab vs OWASP Zap comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 20, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

GitLab
Ranking in Static Application Security Testing (SAST)
7th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
85
Ranking in other categories
Application Security Tools (10th), Build Automation (1st), Release Automation (2nd), Rapid Application Development Software (11th), Software Composition Analysis (SCA) (5th), Enterprise Agile Planning Tools (2nd), Fuzz Testing Tools (2nd), DevSecOps (1st)
OWASP Zap
Ranking in Static Application Security Testing (SAST)
11th
Average Rating
7.6
Reviews Sentiment
7.3
Number of Reviews
41
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2025, in the Static Application Security Testing (SAST) category, the mindshare of GitLab is 2.5%, up from 2.4% compared to the previous year. The mindshare of OWASP Zap is 4.6%, down from 4.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST)
 

Featured Reviews

Rohit Kesharwani - PeerSpot reviewer
Improved agility and time to market with CI/CD enhancements
The CI/CD pipelines in GitLab ( /products/gitlab-reviews ) are highly valuable. Another important feature is the single source of repository, allowing efficient repository management and source code management. GitLab provides manageability by allowing us to manage source code effectively through separate repositories. Additionally, GitLab enables the creation of individual CI/CD pipelines for each repository, making software more agile. By integrating GitLab as a DevOps platform, we have enhanced agility, improved our time to market, and different teams can work collaboratively on various projects.
Amit Beniwal - PeerSpot reviewer
Simplifies vulnerability discovery and has high quality support
There are areas for improvement with OWASP Zap, particularly in the alignment of vulnerabilities concerning CVSS scores. Sometimes, a vulnerability initially categorized as high severity may be reduced to medium or low over time after security patches are applied. This alignment with the present severity score and CVSS score could be improved.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution makes the CI/CD pipelines easy to execute."
"GitLab has better support, and its features are superior compared to Jenkins."
"I find the features and version control history to be most valuable for our development workflow. These aspects provide us with a clear view of changes and help us manage requests efficiently."
"We like that we can create branches and then the branches can be reviewed and you can mesh those branches back. You can independently work with your own branch, you don't need to really control the core of other people."
"Their CI/CD engine is very mature. It's very comprehensive and flexible, and compared to other projects, I believe that GitLab is number one right now from that perspective."
"Everything is easy to configure and easy to work with."
"GitLab's best features are continuous integration and fast deployment."
"We're only using the basic features of GitLab and haven't used any advanced features. The solution works fine, so that's what we like about GitLab. We're party using GitHub and GitLab. We have a GitHub server, while we use GitLab locally or only within our team, and it works okay. We don't have any significant problems with the solution. We also found the straightforward setup, stability, and scalability of GitLab valuable."
"​It has improved my organization with faster security tests.​"
"We use the solution for security testing."
"Fuzzer and Java APIs help a lot with our custom needs."
"The scalability of this product is very good."
"The solution is good at reporting the vulnerabilities of the application."
"Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope."
"The community edition updates services regularly. They add new vulnerabilities into the scanning list."
"The stability of the solution is very good."
 

Cons

"We would like to generate document pages from the sources."
"I would like to see security increased in the future. A secure environment is very important."
"GitLab can improve its user interface to make conflict resolution more user-friendly."
"The solution does not have many built-in functions or variables so scripting is required."
"I believe there's room for improvement in the advanced features, particularly in enhancing the pipeline functionalities."
"Reporting could be improved."
"I would like to see better integration with project management tools such as Jira."
"Currently, GitLab is not easy to scale because GitLab has specific deployment instructions. We deploy it on one of the VMs."
"I'd like to see a kind of feature where we can just track what our last vulnerability was and how it has improved or not. More reports that can have some kind of base-lining, I think that would be a good feature too. I'm not sure whether it can be achieved and implement but I think that would really help."
"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline."
"The forced browse has been incorporated into the program and it is resource-intensive."
"It would be nice to have a solid SQL injection engine built into Zap."
"The reporting feature could be more descriptive."
"Sometimes, we get some false positives."
"When comparing OWASP Zap and Burp Suite, the main difference besides pricing is that OWASP Zap has limitations with reporting levels and UI, which affects its reporting capabilities, whereas Burp Suite is already advancing with new AI features and scanning capabilities that OWASP Zap seems to be lacking."
"The documentation needs to be improved because I had to learn everything from watching YouTube videos."
 

Pricing and Cost Advice

"It seems reasonable. Our IT team manages the licenses."
"As I work in a vast enterprise, I'm unsure about the licensing cost for GitLab. It's the management team that takes care of that."
"I'm not aware of the licensing costs because those were covered by the customer."
"We are using its free version, and we are evaluating its Premium version. Its Ultimate version is very expensive."
"GitLab is comparatively expensive, but it provides value because it's feature-rich."
"I don't mind the price because I use the free version."
"GitLab is highly priced for smaller teams, but it's okay if considering a user base of thousands."
"It is very expensive. We can't bear it now, and we have to find another solution. We have a yearly subscription in which we can increase the number of licenses, but we have to pay at the end of the year."
"The tool is open-source."
"As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."
"The solution’s pricing is high."
"The tool is open source."
"This is an open-source solution and can be used free of charge."
"This solution is open source and free."
"It is open source, and we can scan freely."
"This app is completely free and open source. So there is no question about any pricing."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
861,524 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
14%
Computer Software Company
13%
Government
10%
Manufacturing Company
10%
Computer Software Company
17%
Financial Services Firm
11%
Manufacturing Company
7%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about GitLab?
I find the features and version control history to be most valuable for our development workflow. These aspects provide us with a clear view of changes and help us manage requests efficiently.
What is your experience regarding pricing and costs for GitLab?
The pricing and cost are on par with other tools and are neither too expensive nor cheap.
What needs improvement with GitLab?
Regarding improvements, making task management is something that GitLab can potentially make easier, similar to what DevOps or Jira does.
Is OWASP Zap better than PortSwigger Burp Suite Pro?
OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with ...
What do you like most about OWASP Zap?
The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, i...
What is your experience regarding pricing and costs for OWASP Zap?
OWASP might be cost-effective, however, people prefer to use the free edition available as open source.
 

Comparisons

 

Also Known As

Fuzzit
No data available
 

Overview

 

Sample Customers

1. NASA  2. IBM  3. Sony  4. Alibaba  5. CERN  6. Siemens  7. Volkswagen  8. ING  9. Ticketmaster  10. SpaceX  11. Adobe  12. Intuit  13. Autodesk  14. Rakuten  15. Unity Technologies  16. Pandora  17. Electronic Arts  18. Nordstrom  19. Verizon  20. Comcast  21. Philips  22. Deutsche Telekom  23. Orange  24. Fujitsu  25. Ericsson  26. Nokia  27. General Electric  28. Cisco  29. Accenture  30. Deloitte  31. PwC  32. KPMG
1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS
Find out what your peers are saying about GitLab vs. OWASP Zap and other solutions. Updated: July 2025.
861,524 professionals have used our research since 2012.