Scans, branches and quality gates
Vulkro Cloud scans the branches you track. Each scan can run by hand, on a schedule or on a push, and a quality gate decides whether it passes.
Tracked branches
The default branch is always tracked. Add more when you connect the repository or from its Branches tab (Add Branch). A branch's menu has Scan Now, Make Default Branch, Stop Tracking and SARIF and CSV downloads of its latest results.
Scheduled scans
Each branch has a schedule: Off, Every 6 hours (Business and up), Daily or Weekly. New branches start with it off.
Every scan counts toward your plan's Cloud scans a day, however it starts. Failed and cancelled scans do not count, and the day resets at 00:00 UTC. At the limit, manual scans are refused and scheduled ones are skipped and reported.
For Salesforce orgs, see Connect Salesforce orgs.
Scan on push
- In the repository's settings, open Webhook and Generate Secret (shown once).
- Add a webhook on the git host with the address and secret shown.
- Turn on Scan on Push for each branch.
A push scans the branch; a pull request into a tracked branch starts a pull-request check. Repositories connected through the Vulkro GitHub App, or a GitLab or Bitbucket sign-in, need no secret of their own. Unsigned deliveries are refused:
| Host | Signature header |
|---|---|
| GitHub | X-Hub-Signature-256 |
| GitLab | X-Gitlab-Token |
| Bitbucket | X-Hub-Signature (sha256) |
Limit: 60 deliveries every 10 minutes per repository. Not available for Other / Self-Hosted repositories.
Quality gates
Every workspace has a Default gate. It fails when a scan finds any new Critical, any new High, or any new secret. "New" means first seen on the default branch within the new-code period (30 days by default, 1 to 365, set on the Quality Gates page).
You can create up to 50 gates and pick one per repository. Each condition fails when its count is above a whole-number threshold (0 fails on the first):
| Metric | Counts |
|---|---|
| New Critical / High / Medium issues | Issues of that severity first seen in the new-code period |
| New issues | Every issue first seen in the new-code period |
| New proven issues | New issues with a proven attack path |
| Open Critical / High issues | Every open issue of that severity |
| New secrets | Secrets first seen in the new-code period |
The result shows in the branch's Gate column, the scan record, the dashboard and on pull requests. The "Quality Gate Failed" notification can alert you.
The same check runs locally and in CI with vulkro gate.