Web Security Auto-populate converts supported OWASP ZAP output into normal voiqq findings for an OWASP ASVS project. It helps organize scanner evidence; it does not independently confirm exploitability or risk.
How the integration works
voiqq parses the uploaded report as untrusted data, normalizes alerts and instances, applies deterministic duplicate detection, and suggests canonical ASVS mappings where the scanner evidence supports them.
What you need
- A Web Application Security project with the intended ASVS scope
- A ZAP report produced during an authorized assessment
- Enough endpoint, parameter, evidence, and environment context for review
- Removal of credentials, tokens, and unrelated personal data before upload
A practical workflow
- Open Auto-populate in the Web Application Security project
- Upload the supported ZAP JSON report
- Review parsed alerts, instances, warnings, and suggested requirements
- Accept legitimate candidates into the normal finding workflow
- Confirm severity, exploit context, remediation, retest status, and report inclusion
What enters the project
- Alert name, description, risk, confidence, endpoint, and parameter
- Request or response evidence retained in the intended project fields
- CWE, WASC, reference, and likely ASVS requirement
- Scanner source metadata and duplicate fingerprint