use env var for ZAP path