What is Vulkro?
Vulkro is a security scanner that runs on your own machine. Point it at your code and it finds the bugs that turn into breaches: the missing access check, the query a user can rewrite, the password left in the source, and the known vulnerabilities hiding in your dependencies. It reads your code without running it, and your code never leaves your computer.
It is one binary. There is no server to stand up, no database to configure, and nothing for your app to install at runtime.
In one minute
- Local. Every scan the CLI, the VS Code extension and the local console run happens on your machine. Your code is never uploaded.
- Repeatable. The same code gives the same result every time. No AI sits in the scan, so a scan today matches a scan tomorrow.
- Built for CI. It can stop a build when it finds something serious, and it explains why.
- Honest. It shows you the exact path a bug takes through your code, and we publish what it misses, not just what it catches.
What it checks
| It looks at | And finds |
|---|---|
| Your API | Every HTTP endpoint in your code, and which ones anyone can reach without logging in. |
| Common vulnerabilities | The OWASP API Top 10 plus 50+ specific checks: SQL injection, XSS, SSRF, IDOR, CSRF, command injection, mass assignment, weak crypto, and more. |
| Secrets | Passwords, API keys, and tokens left in your code, config, and git history. |
| Dependencies | Known CVEs in your packages, with the ones that actually reach your code flagged first. |
| Compliance | Audit-ready evidence mapped to SOC 2, PCI DSS, HIPAA, GDPR, ISO 27001, and more. |
Which languages it supports
Every language below is included in the 14-day trial and in every plan.
- Full analysis: JavaScript, TypeScript, Python, Go, and Java with first-class Spring Boot support, including the popular frameworks (Express, Next.js, FastAPI, Django, gin, Spring, and others).
- Single-function analysis: PHP, C and C++. Vulkro checks the shape of risky calls and follows untrusted input to a dangerous call inside one function. It does not yet follow data from one function into another in these languages.
- Every other language: dependency (CVE) scanning from your lockfiles.
- Salesforce (Apex, LWC, Aura, Flow, Visualforce) is a separate product, Vulkro for Salesforce.
See Supported languages and frameworks for the full list.
Why it runs on your machine
Most scanners work the other way around: you upload your code to their cloud, and they send findings back. That is a non-starter for regulated teams, on-premise setups, and anything air-gapped. It also makes CI unreliable, since the version scanning your pull request today may not be the one that scanned it last week.
The Vulkro scanner is the opposite. One binary, everything local, and the same answer every run. Pull the network cable and it still works.
For teams that want scans on a schedule, pull-request checks and one shared list of issues, Vulkro Cloud is the hosted option: it scans each connected repository or Salesforce org in its own isolated container. Nothing reaches Vulkro Cloud unless you connect it.
What it will not do
- It does not run your code. Every scan is static.
- It does not send your code or findings anywhere. On its own it makes
only two calls: an anonymous install heartbeat (counts, never content) and
the daily licence refresh for your signed-in trial or Pro. Everything else, such as
downloading the CVE bundle with
vulkro update, happens only when you ask.VULKRO_OFFLINE=1turns every outbound call off. See Telemetry. - It does not replace a human review. It catches a large share of what a reviewer would, in a fraction of the time.
- It does not pretend to be perfect. Our benchmark is public and reproducible, and we leave the misses in.
Words we use
Findings talk about entry points, untrusted data flow, sinks, proof tiers and
SBOMs. The glossary explains each one in a sentence,
and vulkro glossary <term> prints the same definition on the terminal.
Where to go next
- Start a 14-day trial - a card at checkout, nothing charged during the trial. Vulkro is a paid tool, and scanning needs an active trial or Pro.
- Install - one line, on macOS, Linux, or Windows.
- Run your first scan -
vulkro scan .and what the output means. - Add it to CI - copy-paste GitHub Actions, GitLab CI, and pre-commit setups.
- See the benchmark - how accurate it is, misses included.