zap-hud
zap-hud copied to clipboard
zaproxy
Document HUD security model and features
Clearly explain the HUD security model and how it protects against specific threats.
Just added https://github.com/zaproxy/zap-hud/wiki/Security @dscrobonia @thc202 @kingthorin is that enough to close this issue?
Looks good to me, just two quick things:
Note that if you are using ZAP with potentially malicious web sites then you should not allow ZAP to be accessed by arbitrary IP addresses or disable any of the ZAP API security features.
Should probably link to the relevant FAQ(s) or help content.
For even more security you might want to run ZAP in a container like Docker.
Have you tried using HUD from within docker? I have no idea what that would look like or if it's practical.
Have updated to state the default setting are safe but can be updated via the API Options Screen (which is linked to). Will try the HUD via docker asap - I really want that to work well ;)
Added https://github.com/zaproxy/zap-hud/wiki/Using-the-HUD-with-ZAP-in-Docker and linked to it :D
