vulkro compliance
Check findings against a compliance profile and report each control's status.
vulkro compliance . --profile soc2
vulkro compliance . --profile pci --format json
Each finding maps to every control it touches (a CSRF finding counts against ASVS, PCI and CIS at once). Controls are checked against the same findings vulkro scan shows. To write a folder of audit evidence instead, use vulkro compliance-pack.
Flags
| Flag | Description |
|---|---|
[PATH] | Project root. Default .. |
--profile <NAME> | owasp-asvs (default), owasp-web, pci, soc2, hipaa, nist-ssdf, nist-800-53, stateramp, iso27001, cis, cwe-top25, gdpr. |
--all-confidence | Check every finding, not just the default set. The count line says which set was used. |
-f, --format <FMT> | table (default), json, sarif, csv and the other output formats. |
Exit codes
0 report printed, 2 unknown profile or a scan or IO error. It reports coverage rather than failing on findings, so it never returns 1.
See also: Compliance overview.