Does my scan data ever leave my machine?

No. Findings and the HTTP traffic behind them are stored in a local SQLite database under ~/.vooki-pro/, and the AI model runs on your device. Outbound traffic is limited to the target you are scanning, licence validation, the one-time AI model download, and any integrations you set up yourself.

Which platforms are supported?

macOS 11+ (a signed and notarised .dmg for Apple Silicon), Windows 10+ 64-bit (an installer) and Linux (an AppImage for Ubuntu 20.04+, Debian 11+, Fedora 32+). There is no SaaS or browser version. Every machine needs at least 16 GB of RAM.

Can it scan an application behind a login?

Yes. It supports form login, bearer token, API key, HTTP basic, OAuth2 client credentials, raw headers and cookies, or a recorded browser session for SSO. It can log in again automatically if the session expires mid-scan. See Auth profiles.

Can it scan single-page apps (React, Angular, Vue)?

Yes. Record a browser session and use Hybrid discovery, and keep Discover background / API requests ticked so XHR and fetch calls are captured. See Browser recordings.

Does it do SAST, SCA, network or mobile scanning?

No. Vooki Pro is DAST only: it tests running web applications and REST APIs. It also has no manual pentest tooling such as an intercepting proxy, repeater or fuzzer. Android app scanning is not part of Vooki Pro.

Can I run it in a CI/CD pipeline?

Yes. Export any scan as a JSON config and run it with vooki-pro-cli. Set a severity threshold and the build fails on its own when something at or above it is found. See CLI and CI/CD.

Is it safe to scan production?

An active scan sends real attack payloads and can create or change data, so scan staging wherever you can. For production, use a custom policy without destructive and denial-of-service checks at Stealth speed, or set "testing_mode": "passive" in the CLI.

How is it licensed?

Per domain, per year. One slot covers a domain and all of its subdomains, and installs are unlimited. There is a 7-day full-feature trial with no card needed. See Licensing and domains.

Which compliance frameworks do reports cover?

OWASP Top 10, PCI DSS v4, NIST SP 800-53, ISO/IEC 27001, HIPAA, GDPR and SOC 2. See Reports and compliance.

I used an earlier version of Vooki (5.x). Can I carry my projects over?

Projects from Vooki 5.x cannot be opened in Vooki Pro 6. Re-import the original source (a Postman collection, OpenAPI spec or HAR capture), or recreate web targets as applications.

How do I get help?

Email support@vookify.com with the version from Settings → About, and ~/.vooki-pro/logs/crash.log if the app closed unexpectedly. You can also ask in the community forum.