vulkro dataflow
Map where outside data enters the app, what it passes through, and where it ends up.
vulkro dataflow .
vulkro dataflow . --reaching-sink --min-severity high --format mermaid
For every input (REST endpoints and events) it lists the functions and classes the data passes through, the sinks and stores it reaches, sanitisers on the way and whether it carries PII. By default every input is shown; the filters narrow it.
Flags
| Flag | Description |
|---|---|
[PATH] | Project root. Default .. |
-f, --format <FMT> | table (default), json (nodes, edges, flows), mermaid, dot or markdown (one section per input). |
--reaching-sink | Only flows that reach a security-relevant sink. |
--sensitive | Only flows that carry PII. |
--min-severity <SEV> | Only flows whose worst sink is at least critical, high, medium, low or info. |
--source <TEXT> | Only inputs whose label contains this text, for example --source /users. |
--no-cache | Skip the per-file extraction cache. |
--force-app, --force-all-rules | Same as on vulkro discover. |
Exit codes
0 success, 2 bad argument or internal error. It documents rather than gates, so it never returns 1.
See also: Taint analysis, Local console.