Skip to main content

vulkro data-map

Map the database: every table and sensitive column, who reaches it and through which route.

Command reference​

Generated from vulkro data-map --help (vulkro 0.41.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Map the database: every table and sensitive column, who reaches it and through which route.

vulkro data-map [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the project root (default: current directory) Default: ..

Options​

FlagDescription
-f, --format <FORMAT>Output format. Default: table.
--offlineHard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set.
--focus <NODE_ID>Only the two-hop neighbourhood of one node, by id (e.g. --focus table:users, --focus audience:anonymous)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-cacheBypass the per-file extraction cache (~/.vulkro/scans.db)
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
--force-appBypass the framework self-scan heuristic (see discover --force-app)
--force-all-rulesBypass the posture-based rule-applicability gate (see discover --force-all-rules)
-h, --helpPrint help (see a summary with '-h')
Full vulkro data-map --help
Map the database: every table and sensitive column, who reaches it and through which route.

Scans the project and joins the schema (ORM models and migrations), the endpoint lineage, the route auth facts and the findings into one graph: stores, sensitive fields, row-scope policies, entry points and audiences. Every edge carries a proof grade (proven / resolved / metadata / detector) and the `file:line` fact behind it; degree and blast radius are computed per node. The same document is served by the console at `GET /api/scans/:id/data-map` and stored in the scan JSON as `data_map` (omitted when the project has no schema).

The map draws only what the scan saw: the `coverage` block lists the facts it does not collect (SQL views, triggers, cascade rules, raw SQL joins), and the absence of an edge is never a protection claim.

Exit codes: `0` success (including a project with no schema, which prints an honest-empty map), `2` arg error or internal failure. The map documents rather than gates, so exit `1` is not used.

Usage: vulkro data-map [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
  -f, --format <FORMAT>
          Output format

          Possible values:
          - table: Human-readable summary: stores by blast radius, exposures, gaps
          - json:  The map document (`version`, `nodes`, `edges`, `coverage`, `stats`)
          
          [default: table]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --focus <NODE_ID>
          Only the two-hop neighbourhood of one node, by id (e.g. `--focus table:users`, `--focus audience:anonymous`)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-cache
          Bypass the per-file extraction cache (`~/.vulkro/scans.db`)

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

      --force-app
          Bypass the framework self-scan heuristic (see `discover --force-app`)

      --force-all-rules
          Bypass the posture-based rule-applicability gate (see `discover --force-all-rules`)

  -h, --help
          Print help (see a summary with '-h')
Last updated on