vulkro scan

Scans a project for security findings: endpoints and auth, attack paths, secrets, dependency CVEs, IaC and more.

vulkro scan .                                   # same as `vulkro scan ci .`
vulkro scan . --format sarif > vulkro.sarif     # for code scanning
vulkro scan . --fail-on critical,high           # CI gate

Presets

vulkro scan quick .          # or: vulkro scan --preset quick .

Preset	Use	Sets
quick	Pre-commit	--min-confidence high, --scope src, --since HEAD~1
ci (default)	CI	--gate and a fail-on Critical + High exit policy
deep	Before a release	--all-confidence, --include-unreachable, --min-evidence 0.0

A flag you pass always wins over the preset. Bare vulkro scan . prints a one-time hint naming the preset; VULKRO_QUIET_PRESET_HINT=1 silences it.

Main flags

Flag	Description
-f, --format <FORMAT>	Output format (see below). Default table.
--fail-on <SEVERITIES>	Severities that cause exit 1, for example critical,high.
--gate	Use the [quality_gate] thresholds in vulkro.toml (overrides --fail-on).
--gate-vs <REF>	Exit code counts only findings on lines changed since REF.
--diff-only <REF>	Scan only files changed since REF.
--baseline <FILE>	Report only findings not in a saved baseline.
--ratchet	Fail only on findings new since .vulkro-baseline.json. --ratchet-strict requires the file.
--min-confidence <LEVEL>	high, medium (default) or low.
--all-confidence	Show every finding (same as --min-confidence low).
--scope <SCOPE>	all (default) or src (drop Dockerfile, lockfile, IaC and docs findings; keeps .env* and k8s manifests).
--save	Save the run to ~/.vulkro/scans.db for history, trends and the console.
--web	Scan, save, then open the local console.
--profile <PROFILE>	Add a compliance evaluation: owasp-asvs, pci, soc2.
--pq-audit	Flag RSA, ECDSA, ECDH and classical Diffie-Hellman for post-quantum migration.
--validate-secrets	Check found secrets against the provider (network call; off by default).
--post-to <DEST>	Send a summary to slack, teams, jira or pagerduty after the scan.

Run vulkro scan --help for the rest (--min-severity, --rule-pack, --since, --triage, --strict-confidence, --include-unreachable, --top, --jobs, --no-cache and more).

Output formats

Use	Formats
Terminal and tooling	table, json, ndjson, csv, junit
Code scanning and pull requests	sarif, gh-pr, gh-pr-inline, github-annotations, gitlab-mr, bitbucket-pr, azure-pr
SBOM and VEX	cyclonedx, cyclonedx-1.7, spdx, spdx3, openvex, cyclonedx-vex, cbom, cbom-1.7, aibom
Reports and evidence	pdf (needs wkhtmltopdf), ropa-md, ropa-html, evidence-graph

See Output formats.

Gating in CI

vulkro scan ci . --fail-on critical,high          # fail on any Critical or High
vulkro scan . --gate-vs origin/main               # fail only on new lines in this PR
vulkro scan . --ratchet                           # fail only on findings new since the baseline

Findings Vulkro flags but cannot decide offline (disposition not-examined, such as object-level authorization) never fail the run. They stay in the report.

Inline suppression

# vulkro:disable-next-line API2
@router.get("/health")
def health(): ...

// vulkro:disable-file at the top of a file silences the whole file. The rule id can be a detector id or an OWASP code such as API1. See Suppressions.

Exit codes

Code	Meaning
0	No findings at or above --fail-on (or the gate passed).
1	Findings reported, a gate or ratchet block, or no licence (vulkro: license_required).
2	Bad arguments, IO failure or internal error.

A tree where no source file could be examined is never 0: it is 2, or 1 if dependency, container, IaC or secret checks still reported findings.

See also: vulkro gate, Confidence model, Baselines.