Vooki Pro covers the full loop — define an application, discover its real attack surface, authenticate, scan it with 498 checks, triage with an on-device AI model, retest what you fixed, and hand an auditor a compliance report. No server to stand up, no scan data leaving your network.
Every screen in the app maps to a stage of the same workflow.
Everything in Vooki Pro hangs off an application. Register the thing you own once, tag it with an environment, and every scan, finding and report for it collects in one place instead of scattering across screens.
Open any application into its own tab and get a dedicated work surface with three views, so you never have to cross-reference three screens to answer “how is this app doing?”
A scanner is only as good as the URLs it knows about. Vooki Pro gives you four discovery strategies plus a headless pass for the endpoints a static crawler structurally cannot see — and lets you fence all of it with scope rules and budgets.
Scan the start URL and the requests you hand it. Fastest path from URL to findings.
Follow links from the start URL to a chosen depth, mapping the site as it goes.
Replay a browser session you recorded, so the scanner walks the exact paths a real user did.
Replay the recording, then crawl outward from its URLs. The recommended mode for single-page apps.
A static crawler reads <a href> out of raw HTML — it never runs your JavaScript, so it never sees the REST calls your front end actually makes. An optional headless Chromium pass loads a capped set of high-value pages and captures only the XHR and fetch traffic they fire, then scope-filters and de-duplicates it.
Modern apps fan out across a dozen hosts. One headless page load records every host the page talks to and classifies each one — main application, API, authentication, static, CDN or third party — so you pick your scope from a list instead of typing domains from memory.
Discovery is bounded by whichever limit you hit first, so a scan against a large site can't run away with your afternoon.
The single most useful thing you can give a DAST tool is a walkthrough of your own application. Vooki Pro opens a real Chromium window, you use the app normally, and every request the browser makes is captured — then reused three different ways.
There is no man-in-the-middle proxy to configure and no certificate to install. Vooki Pro drives a headed Chromium and listens to the browser's own network events, which means it sees every request including XHR and fetch, with none of the TLS friction a proxy brings.
When you stop recording, the captured session can be turned into any of:
Unauthenticated scans find the login page and little else. Vooki Pro supports six credential types as reusable profiles, plus a recording-based login for the applications that resist scripted authentication entirely.
Store credentials once, reuse them across every scan and schedule for that application.
A policy decides which of the 498 checks actually run. Five built-in policies cover the usual trade-offs between speed and depth; a custom policy lets you tick individual checks one by one.
Build a policy from the full catalogue, grouped by category, and tick exactly the checks you want. Useful when a compliance scope, a fragile production system or a narrow retest window means the built-in profiles are the wrong shape.
All 498 checks individually selectable306 active checks across 26 attack categories, 189 version-fingerprint checks for outdated software, and three deep analysis passes — 498 in total, each one individually selectable in a custom policy.
| Category | Checks |
|---|---|
| Information Disclosure | 43 |
| Configuration | 36 |
| Client-Side Security | 28 |
| Injection Attacks | 22 |
| Security Headers | 19 |
| OAuth / OIDC / SAML | 16 |
| Authentication Failures | 15 |
| API Security Issues | 12 |
| HTTP Protocol | 12 |
| Cryptographic Failures | 11 |
| Broken Access Control | 9 |
| Cookie Security | 8 |
| File Security | 8 |
| Cross-Site Scripting (XSS) | 7 |
| Business Logic Vulnerabilities | 7 |
| Session Management | 7 |
| Denial of Service | 7 |
| SSRF & Related | 6 |
| Insecure Deserialization | 6 |
| LLM Security | 5 |
| CVE-Class Attacks | 5 |
| CSRF Attacks | 4 |
| Encoding Attacks | 4 |
| Web Cache Deception | 3 |
| Prototype Pollution | 3 |
| DNS Security | 3 |
189 fingerprint checks identify the software behind an application and flag versions with known vulnerabilities, grouped into seven readable buckets.
APIs have no links to crawl, so they need a different front door. Import a spec, a collection or a capture — or build the requests by hand — then scan every request in the project as a single run.
Format is auto-detected from the file. Every operation becomes an editable request with its method, path, headers and body intact. A browser recording can also be converted straight into an API project.
A request workbench for shaping an API project before you scan it.
Twelve checks target the API Security Top 10 failure modes that generic web scanning misses entirely.
Scans run in the background in their own tabs. You can start a second one, triage an older run, or edit an API project while the first is still going.
The web scan wizard walks six steps, each with a live summary on the review screen before anything is sent.
The API wizard follows the same shape, with Project in place of Target and Discovery.
Every run opens into five views:
Vooki Pro ships an AI layer that runs entirely on your machine. Not an API key, not a cloud endpoint with a data-processing agreement — a language model file on your own disk.
ThreatLens performs passive analysis on captured HTTP responses during a scan, surfacing suspicious patterns the deterministic checks aren't looking for and enriching findings as they are raised.
Scan traffic is the most sensitive data your security tooling touches — session tokens, personal data, internal hostnames, and the exact requests that break your application.
Because the model is local, none of it is sent to a third-party AI service. There is no vendor to trust with your findings and no egress for a reviewer to sign off on.
Raising a finding is the easy part. Vooki Pro is built around what comes after — proving it, deciding about it, and checking the fix.
Every finding from every scan in one browser, filterable by severity, finding type, and originating scan, with free-text search across the set.
Each finding opens into four tabs:
When a developer says it's fixed, retest re-runs the same automated detector that raised the finding and returns a verdict with the fresh response attached. You don't hand-craft anything — the check that found it is the check that confirms it.
Vulnerability KB. A built-in reference catalogue of 358 entries across 27 categories — what each finding type means, its severity, how to fix it and which controls it maps to. Browse it any time, not just when a scan raises something.
Four standard formats for engineering, seven mapped compliance reports for auditors, and a portable archive for moving a whole scan between machines.
Executive summary, risk breakdown and per-finding evidence. HTML and PDF for circulation, DOCX when someone needs to edit the wording, JSON when a machine is reading it.
The same findings, reorganised control by control against the framework you are being assessed on. Available as HTML or PDF.
Export a complete scan as a single .vpscan file and import it into another Vooki Pro install — useful for handing a run to a colleague or moving work between machines.
Point-and-click when you're exploring; scheduled and headless when the scan should just happen.
Any scan the wizard can configure can be saved as a schedule instead of — or as well as — running now.
Export a scan you configured in the wizard as a JSON config, then run it from a terminal or a pipeline. The config is self-describing — the report format and type live inside it, so one command produces different outputs for different configs.
The config carries the full scan definition — target and scope, discovery strategy and budgets, authentication, policy, report format (HTML, JSON, DOCX or PDF), report type (standard or compliance, with the framework named), and an optional .vpscan export so the complete run can be imported back into the desktop app afterwards.
Findings are only useful once they reach the place your team actually works.
Push a finding straight into your tracker as a ticket, with its evidence and remediation attached. One platform is active at a time.
Get told when a scan finishes rather than watching it. Notification channels run independently of ticketing — you can have both, or either.
Vooki Pro is a desktop application. That is a deliberate architectural choice, not a limitation — it is what makes the privacy guarantee real rather than contractual.
Native builds for macOS and Windows, plus a Linux AppImage. Install and scan — there is no server component to deploy, scale or patch.
Applications, scans, findings, evidence and reports live in a local database on your machine. Nothing is uploaded.
An append-only audit trail of what was done and when, filterable and exportable to CSV as compliance evidence.
A full dark and light theme, plus configurable date formats, request rate limits, timeouts and proxy settings.