zaproxy.org
ZAP, the Zed Attack Proxy, is a free and open source web app scanner maintained as a community project. It provides options for security automation, including packaged scans and an automation framework, and a marketplace of community-contributed add-ons.