Vega

Spec sheet

Purpose

Vega is a GUI-based platform for testing the security of web applications.Read 7 Oct 2026 · subgraph.com

Product

Vega is a GUI based platform for testing web application security, written in Java.Read 7 Oct 2026 · subgraph.com

Support

Subgraph points users to online documentation, the #subgraph OFTC IRC channel, the Vega-Users Google Group, and GitHub issues for bug reports and feature requests.Read 7 Oct 2026 · subgraph.com

Headquarters

Montreal, CanadaRead 28 Sep 2026 · subgraph.com

Maker

Vega is developed by Subgraph, described in its documentation as an open source security startup based in Montreal, Canada.Read 7 Oct 2026 · subgraph.com

Alerts

Scanner modules can generate XML-based alerts, with links to saved requests and responses.Read 7 Oct 2026 · subgraph.com

Authenticated proxy scanning

The proxy scanner can use client cookies to preserve authenticated sessions while scanning target paths.Read 7 Oct 2026 · subgraph.com

Authentication

Automated scans support HTTP Basic, HTTP Digest, NTLM, and macro based form authentication; scanner requests can also include configured cookies.Read 7 Oct 2026 · subgraph.com

Automated scanning

Its scanner crawls websites, processes forms, finds possible injection points, and runs modules that can test for issues such as cross-site scripting and SQL injection.Read 7 Oct 2026 · subgraph.com

Discontinued

Subgraph says Vega is discontinued.Read 7 Oct 2026 · subgraph.com

Extensibility

Vega supports JavaScript modules for active fuzzing and response processing, and modules can generate XML based alerts.Read 7 Oct 2026 · subgraph.com

HTTPS interception

For HTTPS inspection, Vega generates replacement certificates signed by its own certificate, which can be imported into the browser.Read 7 Oct 2026 · subgraph.com

Intercepting proxy

The proxy lets users inspect browser requests and server responses, set breakpoints, and edit intercepted traffic before releasing it.Read 7 Oct 2026 · subgraph.com

Proxy

Its intercepting proxy lets users inspect, hold and edit browser requests and server responses.Read 7 Oct 2026 · subgraph.com

Proxy editing

The proxy message viewer supports HTML syntax highlighting, and binary data can be viewed and edited with a built-in hex editor.Read 7 Oct 2026 · subgraph.com

Proxy scanning

Vega can fuzz parameters and actively test pages in scope as users visit them through the proxy.Read 7 Oct 2026 · subgraph.com

Scan controls

Scanner preferences can limit path descendants, child paths, path depth, duplicate path elements, alert text length, and requests per second.Read 7 Oct 2026 · subgraph.com

Scanner

Its automated scanner crawls websites, extracts links and processes forms to find possible injection points.Read 7 Oct 2026 · subgraph.com

Scanning through proxy

Vega can fuzz parameters and actively test pages in the target scope as users visit them through the proxy.Read 7 Oct 2026 · subgraph.com

Scope behavior

The scanner supports target scopes with multiple base URIs and exclusions, and the documentation says it will not crawl links on other websites.Read 7 Oct 2026 · subgraph.com

Security caution

The scanner guide advises experimenting with Vega on servers that belong to the user and are not in production use.Read 7 Oct 2026 · subgraph.com

Status

The download page states that Vega is discontinued.Read 7 Oct 2026 · subgraph.com

Use limitation

The scanner documentation advises experimenting on servers owned by the user and not in production use.Read 7 Oct 2026 · subgraph.com

Where Specifiction places it

• Web Application Security Scanners#19 of 297.1