Scan with [OWASP ZAP](https://www.zaproxy.org/) a website and save the report under `~/zap-work`

zap-scan.zsh

#!/usr/bin/env zsh

set -euo pipefail

# --- CHECK DEPENDENCIES ---
if ! command -v docker >/dev/null 2>&1; then
  echo "ERROR: docker not found."
  echo "Install Docker:"
  echo "  brew install --cask docker"
  exit 1
fi

if ! docker info >/dev/null 2>&1; then
  echo "ERROR: Docker daemon not running."
  echo "Start Docker Desktop and retry."
  exit 1
fi

# --- INPUT VALIDATION ---
if [[ $# -lt 1 ]]; then
  echo "ERROR: domain is required"
  echo "Usage: $0 <domain> [timeout_minutes]"
  exit 1
fi

DOMAIN="$1"
TIMEOUT="${2:-5}"

# --- NORMALIZE DOMAIN ---
TARGET="https://${DOMAIN}"
DOMAIN_SAFE="${DOMAIN//./_}"

# --- TIMESTAMP ---
TIMESTAMP="$(date -u +"%Y%m%d%H%M%SZ")"

# --- WORKDIR ---
WORKDIR="$HOME/zap-work"
mkdir -p "$WORKDIR"

# --- OUTPUT FILE ---
REPORT_FILE="report-${DOMAIN_SAFE}-${TIMESTAMP}.html"

# --- EXECUTION ---
docker run -t \
  -v "${WORKDIR}:/zap/wrk" \
  ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t "${TARGET}" \
  -r "${REPORT_FILE}" \
  -d -m "${TIMEOUT}"

# --- OUTPUT ---
echo "Report generated:"
echo "${WORKDIR}/${REPORT_FILE}"