The configuration file is tab separated, see https://www.zaproxy.org/docs/docker/baseline-scan/#configuration-file Oh, and ZAP has not been an OWASP project for over a year now :P