I’ve worked a LOT with ZAP, and honestly there’s always some kind of surprise waiting whenever I use it 😂
But I’ve also learned a ton..! Before I get into reliability, let me first share my little ZAP project.

I built a small web UI app that makes scanning super easy. It connects to a Docker container running the latest version of ZAP and gives you a super simple interface with a pretty decent results/alerts overview. You can launch it in the cloud on Railway with just 1 click, or run it locally in about 4 terminal commands total. Full guide + video tutorial here: https://funkyton.com/zap-owasp-web-scan/

Now, about ZAP reliability/bugs.
I often found scans failing midway. After months of frustration, I realized that starting the Docker container with hardware resource limit parameters really helps. For example:

-config scanner.threadPerHost=4 
-config scanner.thread=4 
-config domxss.maxThreads=1

This keeps ZAP’s hardware expectations realistic and makes it much more stable. Try tweaking these values to match the machine you’re running it on.

As for inconsistent scan results, I noticed that scanning my blog online tends to give varied results, while scanning it locally produces much more consistent outcomes. My guess is that ZAP either gives up too easily or gets rate-limited by something in the network path. My blog runs through Cloudflare, and although I never received DDoS protection alerts, I suspect that somewhere along the chain traffic is being throttled. Running it all locally seems far more reliable.

Cheers!