Network egress
This is every outbound call the vulkro scanner can make. A scan itself makes none, and your code, file paths and findings are never sent.
VULKRO_OFFLINE=1 vulkro scan . # zero outbound calls
Automatic calls
Two calls run on their own, in the background, and never block or change a scan.
| Call | When | Destination | Sends | Turn off |
|---|---|---|---|---|
| Heartbeat | At most once every 6 hours, and at most once an hour after a scan | api.vulkro.com/v1/heartbeat | Usage fields only (see Telemetry) | VULKRO_NO_HEARTBEAT=1 or VULKRO_OFFLINE=1 |
| Lease refresh | With the heartbeat, on a signed-in machine | app.vulkro.com/api/v1/auth/device/refresh | The device token only | Same as above. The lease then lapses at its signed expiry; a .lic file needs no refresh |
Calls you start
| Call | Trigger | Destination | Sends |
|---|---|---|---|
| Sign-in | vulkro login | app.vulkro.com/api (VULKRO_ACCOUNT_URL) | Sign-in exchange; returns a signed lease |
| CVE bundle | vulkro update | dist.vulkro.com/cve (VULKRO_CDN_BASE_URL) | Download only; signature and SHA-256 checked |
| Version check | vulkro update only (skip with --no-version-check or VULKRO_NO_UPDATE_CHECK=1) | dist.vulkro.com/releases/latest.json | Download only |
| Live CVE lookup | VULKRO_CVE_LIVE=1 on a scan | api.osv.dev | Name, version and ecosystem of each declared dependency |
| Secret validation | scan --validate-secrets | The provider of each secret found (for example GitHub, Stripe, Slack) | The secret, as an authenticated no-op request |
| Notifications | vulkro notify, scan --post-to | Your Slack, Teams, Jira or PagerDuty endpoint | A scan summary |
| Rule packs | vulkro rules add, rules update | dist.vulkro.com/rules (VULKRO_RULES_REGISTRY_URL) | Download only; signature checked |
| Active probe | vulkro probe --base-url <url> | The URL you give | Test requests (see probe) |
| AI features | A cloud AI endpoint you configure | Your AI provider | The prompt for that feature |
| Vulkro Cloud | vulkro cloud | Your Vulkro Cloud workspace | What that command sends |
| Extension install | vulkro install-extension | dist.vulkro.com (VULKRO_VSIX_URL) | Download only |
The installer (install.sh) downloads the binary and the CVE bundle and sends one anonymous install ping (product, OS, version). Skip the ping with VULKRO_NO_ANALYTICS=1, or everything but the binary with VULKRO_OFFLINE=1.
Every call above is refused or skipped under VULKRO_OFFLINE=1, except a local AI model on 127.0.0.1 or localhost. See Offline mode for each command's behaviour.
Local listeners
These accept connections on loopback only and send nothing out:
vulkro serve: the local console on127.0.0.1:8723, protected by an access token.vulkro mcp serve: stdio by default;--portbinds127.0.0.1.vulkro lsp: stdio only.
Check it yourself
# Linux: a network namespace with no interfaces
unshare -rn strace -f -e trace=connect vulkro scan . --offline
# macOS: watch for connect() calls
sudo dtruss -t connect -f vulkro scan . --offline
The scan should finish with no connect() to a non-loopback address. If you see one, report it to support@vulkro.com.