vulkro prove
Scans the project and writes a runnable test for each eligible finding, so you can confirm it is real. Vulkro only writes the test; you run it.
vulkro prove . # print the tests
vulkro prove . --format emit --out proofs # one file per finding
Eligible findings: SSRF, prompt injection, broken authorization, and SQL, SOQL, NoSQL and command injection. Other findings, and languages without an emitter, are listed as skipped with a reason.
| Language | Test |
|---|---|
| JavaScript / TypeScript | A fast-check property test plus a concrete proof of concept. |
| Python | A Hypothesis test run by pytest. |
| Apex | An @isTest class, runnable in a Salesforce org. |
Each file says how to run it and names the finding id it came from.
Flags
| Flag | Description |
|---|---|
-f, --format <MODE> | stdout (default) or emit (write files). |
--out <DIR> | Output folder for emit. Default .vulkro-proofs. |
--no-cache | Skip the extraction cache. |
Exit codes
0 no tests written (nothing eligible). 1 at least one test written. 2 bad argument or internal failure.
See also: vulkro probe, vulkro explain.