DAST for applications that stopped being pages
GraphQL, WebSocket and single-page application scanners ship together, so the parts of a modern application a crawler never reached are now tested like the rest of it.
- Version
- 5.0
- Released
- February 3, 2026
- New features
- 3
- Category
- Detection
What's new
Features and improvements in this update
New features
3GraphQL scanner
Schema is recovered by introspection or inferred where introspection is disabled, then every query and mutation is tested for authorisation gaps, injection, batching abuse and query depth exhaustion.
WebSocket scanner
The handshake, origin validation and per-message authorisation are tested, and messages are fuzzed after connection, the point at which most WebSocket implementations stop checking anything.
SPA-aware crawling
Client-rendered routes are discovered by executing the application rather than parsing HTML, so React, Vue and Angular applications no longer present as a single page with no links.
Improvements
2Authenticated session handling for SPAs
Token refresh, silent re-authentication and storage-based sessions are handled during long scans, which removes the failure mode where an authenticated scan quietly becomes an unauthenticated one halfway through.
API schema import
OpenAPI and GraphQL schema files can be supplied directly, so endpoints that are never linked from the UI are still tested.
Benefits
What it changes for you
Stated as work removed rather than capability added, the only version of a benefit that can be checked.
The untested half of your application gets tested
For most teams the GraphQL endpoint and the SPA routes are where the sensitive operations live, and they were exactly the parts a traditional crawler could not enumerate.
Authorisation gaps found per operation
GraphQL concentrates authorisation decisions into resolvers. Testing per query and mutation finds the resolver that forgot, which schema review reliably misses.
Fewer scans that silently do nothing
Session handling failures used to produce clean reports for the wrong reason. Detecting and recovering the session means a clean report now means something.
Upgrade
Getting it
Getting this update
Included in 5.0.0. The SPA crawler requires a browser runtime on the scanning host; the GraphQL and WebSocket scanners have no additional dependency.
pip install --upgrade aiptxRelated
Other updates
Nothing gets reported until it has been exploited
Every candidate finding is now validated by replay before it reaches your queue. Unreproducible candidates are dropped rather than downgraded, which is what takes a scanner queue from thousands to dozens.
ReadSecurity testing that runs in the pull request
SARIF output, inline PR annotations and configurable merge blocking bring findings to the engineer who wrote the code, at the moment they can still change it cheaply.
ReadActive Directory and OSINT, in the same assessment
Internal path enumeration and external footprint discovery join the same engine, so the route from a leaked credential to a domain controller is one graph rather than two reports.
ReadSee Your Attack Surface in Real-Time
Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.