Staging environments rarely match production exactly. Sometimes you need to test the live site, but an aggressive scan can create records, send emails or slow the service down. A few precautions make production scanning safe.

How it works

Active scans submit forms and send payloads to every input. On production, that can mean test orders, contact-form spam, or load that affects real users. Passive techniques and careful scoping avoid most of that risk.

Why it matters

• Real customers could be affected by test traffic.
• Business data could be polluted with test records.
• Monitoring and security teams may see the scan as an attack.

Best practices

• Tell your operations and security teams before scanning.
• Exclude destructive actions, logout and payment endpoints from the scope.
• Throttle the request rate and scan outside peak hours.
• Use a passive mode for the first production scan.

How Vooki Pro helps

• Production Safe (Passive) mode sends only non-intrusive GET and HEAD requests.
• Request-rate throttling in every scan, and alerts when the target responds with HTTP 429.
• Include and exclude patterns, host scope and scan limits keep the scan where you want it.
• A guard for state-changing methods, which you can switch off for sensitive systems.

Frequently asked questions

Is it safe to run DAST on production?

It can be, with precautions: passive mode, throttling, excluded destructive actions and agreement from the system owners.

What is passive scanning?

Scanning that only observes normal responses and sends non-intrusive requests, without attack payloads.

Related: Reducing false positives in DAST · Scoping a security scan correctly