Stop Flying Blind: Monitor Webhooks and Portals with Passive ZAP Scans

Solo operators expose dozens of public endpoints—webhooks, client portals, form handlers—but unlike companies with security teams, nobody's checking if they're properly configured. This episode walks through setting up OWASP ZAP's passive baseline scan in Docker, scheduled weekly with cron, to catch missing security headers, CORS misconfigurations, and cookie issues before they cost you a client or a deal. Jordan covers the exact Docker Compose setup, config file tuning with OUTOFSCOPE patterns, exit code automation for Slack alerts, and ticket creation in Linear or Jira. The scan is passive-only and production-safe, designed as a regression safety net that catches configuration drift between deployments. Includes guidance on authenticated scanning with ZAP contexts, the critical endpoint inventory every solo needs, and honest limits about what passive scans can and can't catch.