Using ZAP for security testing