Skip to main content

vulkro demo

Scan a bundled, deliberately vulnerable project so a first run always shows a real finding.

Command reference​

Generated from vulkro demo --help (vulkro 0.36.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Scan a bundled, deliberately vulnerable project so a first run always shows a real finding.

vulkro demo [OPTIONS]

Options​

FlagDescription
--keepKeep the generated project and print its path instead of deleting it, so the code behind each finding can be read and edited.
--offlineHard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set.
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro demo --help
Scan a bundled, deliberately vulnerable project so a first run always shows a real finding.

Points Vulkro at a small, deliberately vulnerable project so a first run always shows real findings, even when your own code is clean. It writes a small deliberately vulnerable project to a temporary directory, scans it exactly as `vulkro scan` would, and prints the findings with their proof.

Offline: it runs the same analysis as a normal scan, on code shipped with Vulkro. Like every scan it needs a licence (start the 14-day trial at app.vulkro.com/billing); without one it exits 1 with `vulkro: license_required`.

Exit codes: `0` the demo scan ran. Findings ARE expected here and are the point, so a finding is not a failure and does not exit 1. `2` error: the temporary project could not be written or scanned.

Usage: vulkro demo [OPTIONS]

Options:
      --keep
          Keep the generated project and print its path instead of deleting it, so the code behind each finding can be read and edited

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on