Vooki Pro covers the full loop — define an application, discover its real attack surface, authenticate, scan it thoroughly, triage with an on-device AI model, retest what you fixed, and hand an auditor a compliance report. No server to stand up, and scan data stays local by default — it leaves your machine only through integrations you configure or reports you export.
Every screen in the app maps to a stage of the same workflow.
Everything in Vooki Pro hangs off an application. Register the thing you own once, tag it with an environment, and every scan, finding and report for it collects in one place instead of scattering across screens.
Open any application into its own tab and get a dedicated work surface with three views, so you never have to cross-reference three screens to answer “how is this app doing?”
A scanner is only as good as the URLs it knows about. Vooki Pro gives you four discovery strategies plus a headless pass for the endpoints a static crawler structurally cannot see — and lets you fence all of it with scope rules and budgets.
Scan the start URL and the requests you hand it. Fastest path from URL to findings.
Follow links from the start URL to a chosen depth, mapping the site as it goes.
Replay a browser session you recorded, so the scanner walks the exact paths a real user did.
Replay the recording, then crawl outward from its URLs. The recommended mode for single-page apps.
A static crawler reads <a href> out of raw HTML — it never runs your JavaScript, so it never sees the REST calls your front end actually makes. An optional headless Chromium pass loads a capped set of high-value pages and captures only the XHR and fetch traffic they fire, then scope-filters and de-duplicates it.
Modern apps fan out across a dozen hosts. One headless page load records every host the page talks to and classifies each one — main application, API, authentication, static, CDN or third party — so you pick your scope from a list instead of typing domains from memory.
Discovery is bounded by whichever limit you hit first, so a scan against a large site can't run away with your afternoon.
Recording is one of the discovery methods — and the single most useful thing you can give a DAST tool is a walkthrough of your own application. Vooki Pro opens a real Chromium window, you use the app normally, and every request the browser makes is captured — then reused three different ways.
There is no man-in-the-middle proxy to configure and no certificate to install. Vooki Pro drives a headed Chromium and listens to the browser's own network events, which means it sees every request including XHR and fetch, with none of the TLS friction a proxy brings.
When you stop recording, the captured session can be turned into any of:
Unauthenticated scans find the login page and little else. Vooki Pro supports six credential types as reusable profiles, plus a recording-based login for the applications that resist scripted authentication entirely.
Store credentials once, reuse them across every scan and schedule for that application.
A policy decides which checks actually run. The built-in policies cover the usual trade-offs between speed, depth and production safety; a custom policy lets you tick individual checks one by one.
Build a policy from the full catalogue, grouped by category, and tick exactly the checks you want. Useful when a compliance scope, a fragile production system or a narrow retest window means the built-in profiles are the wrong shape.
Choose checks individuallyProduction Safe is a built-in scan policy for non-intrusive testing of live applications. Choose it in the scan wizard like any other policy; the scan engine then enforces passive mode — it is not just a setting that can be quietly overridden.
.vpscan archivesVulnerability classes that need active testing are not evaluated in this mode, and the report says so. It records the scan mode, shows what was checked and what was not, and shows compliance controls with no findings as NOT TESTED rather than passing.
Scan Policies reference · Production Safe in the policy reference
Active vulnerability testing across the main web and API weakness families, technology and version detection for outdated components, and deep and passive analysis — each selectable in a custom policy.
Detect the technologies and versions in use and identify outdated components that may need remediation, grouped by type.
Scans run asynchronously in their own tabs within Vooki Pro, so you can keep working while a scan is running — start a second one, triage an older run, or edit an API project.
The web scan wizard walks six steps, each with a live summary on the review screen before anything is sent.
The API wizard follows the same shape, with Project in place of Target and Discovery.
Every run opens into five views:
Raising a finding is the easy part. Vooki Pro is built around what comes after — proving it, deciding about it, and checking the fix.
Every finding from every scan in one browser, filterable by severity, finding type, and originating scan, with free-text search across the set.
Each finding opens into four tabs:
When a developer says it's fixed, retest re-runs the same automated detector that raised the finding and returns a verdict with the fresh response attached. You don't hand-craft anything — the check that found it is the check that confirms it.
Vulnerability KB. A built-in reference catalogue — what each finding type means, its severity, how to fix it and which controls it maps to. Browse it any time, not just when a scan raises something.
Four standard formats for engineering, seven compliance and security-reference report mappings for auditors, and a portable archive for moving a whole scan between machines.
Executive summary, risk breakdown and per-finding evidence. HTML and PDF for circulation, DOCX when someone needs to edit the wording, JSON when a machine is reading it.
The same findings, reorganised control by control against the framework you are being assessed on. Available as HTML or PDF.
Export a complete scan as a single .vpscan file and import it into another Vooki Pro install — useful for handing a run to a colleague or moving work between machines.
Every feature on this page is in the 7-day trial build — no credit card required.
Beyond the scan lifecycle: API scanning, local AI, scheduled and headless operation, integrations and data handling.
APIs have no links to crawl, so they need a different front door. Import a spec, a collection or a capture — or build the requests by hand — then scan every request in the project as a single run.
Format is auto-detected from the file. Every operation becomes an editable request with its method, path, headers and body intact. A browser recording can also be converted straight into an API project.
A request workbench for shaping an API project before you scan it.
API-specific checks target the OWASP API Security Top 10 failure modes that generic web scanning misses.
Vooki Pro's security testing is deterministic. ThreatLens is a separate AI layer on top of it, and it runs entirely on your machine — no API key, no cloud endpoint, a language model file on your own disk.
Rule-based and payload-based testing. Every finding is raised by a detector and carries the HTTP request and response behind it.
Scan traffic is the most sensitive data your security tooling touches — session tokens, personal data, internal hostnames, and the exact requests that break your application.
Because the model is local, none of it is sent to a third-party AI service. There is no AI vendor to trust with your findings and no AI traffic leaving the machine for a reviewer to sign off on. Findings leave only through the integrations you configure or the reports you export.
Point-and-click when you're exploring; scheduled and headless when the scan should just happen.
Any scan the wizard can configure can be saved as a schedule instead of — or as well as — running now.
Export a scan you configured in the wizard as a JSON config, then run it from a terminal or a pipeline. The config is self-describing — the report format and type live inside it, so one command produces different outputs for different configs.
The config carries the full scan definition — target and scope, discovery strategy and budgets, authentication, policy, report format (HTML, JSON, DOCX or PDF), report type (standard, or compliance with the framework named — compliance reports are HTML or PDF), and an optional .vpscan export so the complete run can be imported back into the desktop app afterwards.
Findings are only useful once they reach the place your team actually works.
Push a finding straight into your tracker as a ticket, with its evidence and remediation attached. One platform is active at a time.
Get told when a scan finishes rather than watching it. Notification channels run independently of ticketing — you can have both, or either.
Vooki Pro is a desktop application. That is a deliberate architectural choice, not a limitation — it is what keeps scan data local by default as a matter of architecture rather than contract.
Native builds for macOS and Windows, plus a Linux AppImage. Install and scan — there is no server component to deploy, scale or patch. Scanning needs no internet beyond your target; the license re-checks about once a day while online and works offline for about a week between successful checks.
Applications, scans, findings, evidence and reports live in a local database on your machine and are not automatically uploaded to Vookify. Selected findings leave it only through integrations you configure or reports you export.
An append-only audit trail of what was done and when, filterable and exportable to CSV as compliance evidence.
A full dark and light theme, plus configurable date formats, request rate limits, timeouts and proxy settings.
See how Vooki Pro compares with other web application security testing solutions across AI-assisted vulnerability analysis, deployment, reporting, and licensing.
Burp Suite Professional and Burp Suite DAST, compared separately: scan setup, AI features, report formats and licensing.
The free, open-source scanner and its add-ons against a commercial desktop tool: setup, AI options, compliance reporting and support.
Invicti, Acunetix and StackHawk: deployment model, where scan data and AI processing live, and licensing.
Every feature on this page is in the trial build. Seven days, with scan data stored locally by default.