OWASP ZAP is Apache-2.0 with no paid tier — what does that settle in a tool choice, and what does it not?

## The licence, measured rather than remembered Both of the project's main repositories — the core program and the add-on repository — carry an `Apache-2.0` `LICENSE` file, and the project stamps that same identifier on the container images it publishes, as an `org.opencontainers.image.licenses` label in its own release workflow. The core repository's `LEGALNOTICE.md` says it in one line: the open source software licence of the program is `Apache-2.0`. Apache-2.0 is a **permissive** licence. You may run it, modify it, and redistribute it — including inside something you sell — as long as you keep the notices and the attribution. It carries no obligation to publish your own code, which is the single most common thing candidates get wrong about it. There is no per-seat purchase, no entitlement service, and no separately licensed edition sitting behind the build you downloaded. ## What that settles For an unattended pipeline the consequences are concrete, and they are the reason this question gets asked at all: - **Provisioning.** Nothing has to be bought or allocated before a build agent may run it, so the number of parallel runners is a capacity decision rather than a procurement one. - **Reproducibility.** The build a developer runs on a laptop is the build the pipeline runs; there is no "desktop edition" whose behaviour diverges from the automated one. - **Egress.** Core ships a `-silent` option — also settable through a `ZAP_SILENT` environment variable, which is what you want inside a container — that stops the program making any unsolicited request, the check for updates included. A runner with locked-down outbound access is a supported configuration, not a workaround. - **Escalation.** When something misbehaves, the source is available and is your escalation path. That is a real option, and it is also a bill: your engineers' time instead of a support contract. So the licence takes **price** out of the comparison and leaves **fit**. That reframing is the answer an interviewer is listening for. ## What it does not settle: the download is a bundle The most useful thing to know here is that a top-level `LICENSE` does not describe every file that ships. `LEGALNOTICE.md` keeps a third-party section, and it records **two separate things** that are very easy to merge into one and should not be: 1. The program is a **fork of Paros Proxy**, developed by another company and licensed under the **Clarified Artistic License**. Files inherited from that fork still carry that header today — they are the classes under the `org.parosproxy.paros` packages, which is not a museum corner: the active-scan engine, the network types, the database record classes and the command-line class all live there. 2. **Separately**, files that had been imported under the GPL were later relicensed under `Apache-2.0` with their authors' permission. That is a different set of files and a different event, and conflating it with the fork is the mistake to avoid. On top of both, the distribution ships a `license/` directory holding the Apache text alongside the Clarified Artistic text and the GPL and LGPL texts that bundled libraries require — and `LEGALNOTICE.md` tabulates each bundled library against its licence. | what you are being asked | where the answer actually is | what that source does not cover | |---|---|---| | the project's own licence | `LICENSE` in both main repositories, and `LEGALNOTICE.md` | the files inherited from the fork | | the inherited files' licence | the Clarified Artistic License header on the `org.parosproxy.paros` classes | third-party libraries | | bundled libraries | the table in `LEGALNOTICE.md` and the texts in the distribution's `license/` directory | add-ons you install afterwards | None of this makes the tool hard to adopt. It makes "it is Apache, we are fine" an incomplete sentence, and an open-source review that has been handed that sentence will come back. ## The artefact a review will ask for Core registers a `-sbomzip <path>` command-line option whose own help text reads *"Creates a zip file containing all of the available SBOMs"*. It is worth knowing simply because it turns a manual inventory exercise into one invocation: you run the program once with that option and hand the result to whoever owns the review. Knowing the option exists is a better answer than promising to compile a list by hand. ## How to say this in an interview Lead with the reframing, not the licence name. *"It is `Apache-2.0` with no paid tier, so the choice is not about price — it is about whether the shape of the tool matches how we intend to run it."* Then show that you know the licence question has a second half: the project's own licence is not the whole package's, the fork it came from carries a different one, and the distribution ships those texts because it has to. A candidate who stops at "it's free" has answered the easy half of the question.