Vooki Pro 6.0.0 release notes

Vooki Pro 6.0.0 release notes

Version: 6.0.0
Release date: to be announced
Platforms: macOS 11+, Windows 10 64-bit+, Linux (AppImage)

Vooki Pro 6.0.0 is a rebuilt Vooki Pro: a new desktop DAST scanner for web applications and REST APIs. It follows Vooki Pro 5.4.0. See 5.4.0 release notes.

New

Web application scanning

  • New Scan wizard with Target, Discovery, Authentication, Policy, Schedule and Review steps.
  • Discovery by crawling, by replaying a browser recording, or both (hybrid). It also discovers background XHR/fetch API requests.
  • Scope control: Discovery scope and Attack scope, include/exclude URL patterns, host scope (same host, same domain or custom hosts), scan limits and request-rate throttling.
  • Standalone Crawler screen. Saved crawls can be scanned later.
  • Stop, pause, resume and rescan. A Scope tab shows which discovered URLs were and weren't scanned.
  • Production Safe (Passive) mode: sends only non-intrusive GET/HEAD requests.
  • Warnings when a WAF or anti-bot challenge blocks the scan, on HTTP 429 rate limiting, and when the login session looks invalid.

REST API scanning

  • API Builder: projects with nested folders, environments with {{variable}} syntax, Params/Auth/Headers/Body editors and a response viewer.
  • Import from OpenAPI/Swagger, Postman collections and environments, HAR, cURL, Bruno and Insomnia.
  • Scan a whole API project as one scan, or a chosen subset of its requests. Auto-login and a mid-scan authentication check keep the session valid.

Browser recording and authentication

  • Record a browser session and reuse it for discovery or login. The recordings library supports HAR import and export.
  • Auth profiles: form login (including CSRF tokens), recording-based login, automatic re-login and session-expiry detection.

Scan policies

  • Built-in policies, including Focused (common injection checks only), and a custom policy editor to pick individual checks.

Findings and AI analysis

  • Findings grouped by severity and vulnerability type, with request/response evidence, the injected parameter or payload, Steps to Reproduce, remediation guidance and a CVSS score.
  • Triage states: mark findings as false positive or fixed.
  • ThreatLens: on-device AI triage (Qwen3-8B, downloaded once, about 5 GB) that runs after each scan. Scan data is not sent to a third party. An optional AI detection mode is also available in the scan wizard.

Retest

  • Retest a single finding to check whether a fix worked. The result is kept with the finding and appears in reports.
  • Retest from the command line with vooki-pro-cli retest.

Reports and compliance

  • Standard reports in HTML, PDF, Word (DOCX) and JSON.
  • Compliance reports (HTML or PDF) mapped to OWASP Top 10, PCI DSS v4.0, NIST 800-53, ISO 27001, HIPAA, GDPR and SOC 2.
  • Portable scan archives (.vpscan) for moving scans between machines.

CLI and CI/CD

  • vooki-pro-cli runs the same scans as the wizard from a config file. You can export the config straight from the wizard.
  • SARIF and PDF output. A severity threshold (fail_on_severity) fails the pipeline with exit code 2 when findings at or above it are found.

Scheduling and integrations

  • Scheduled web and API scans. They run in the background, separately from the app window.
  • Create tickets from a finding in Jira, GitHub, GitLab, Linear and Azure DevOps. Send findings to Slack or a webhook.

Licensing

  • 7-day full-feature trial.
  • Per-domain licence: each domain slot covers the domain and its subdomains, with unlimited installs. You can upgrade your domain tier inside the app.

Breaking changes (for users of Vooki Pro 5.x)

  • 6.0.0 is a new application, not an in-place update of 5.4.0.
  • These 5.x features are not included in 6.0.0: Full Scan, Basic Scan, Penetration Test, Domain & Host Scanner and Cryptography.

Get started: Install and activate Vooki Pro ยท Vooki Pro Docs