SOC 2
The soc2 profile maps findings to the SOC 2 Trust Services Criteria that relate to application code.
vulkro compliance . --profile soc2
vulkro compliance-pack . --framework soc2 -o soc2-evidence/
Use --framework soc2-full for the full criteria set (CC1.1 to CC9.2) with a control-by-control HTML table.
Controls
| Control | What fails it |
|---|---|
| CC6.1 Logical access | An endpoint with no detected auth, or BOLA on a path-id route |
| CC6.6 Privileged access | An /admin path that authenticates any user but never checks for an admin role |
| CC6.7 Boundary protection | Outbound requests whose URL includes user input (SSRF) |
| CC6.8 Confidentiality | Responses that dump whole objects, PII in logs |
| CC7.1 Threat detection | Payment, signup or OTP endpoints with no rate limiting |
| CC7.2 Vulnerability mgmt | A CVE match in an installed package |
| CC8.1 Change mgmt | New, removed or version-flipped routes between scans (warns) |
| CC9.1 Risk mitigation | Debug mode, wildcard CORS, hardcoded secrets, default admin credentials |
Criteria that need organisational evidence (control environment, risk assessment, availability) are out of scope for a code scan.
Dated evidence
Auditors ask what was true on a given date. vulkro scan --save stores each scan with its timestamp in ~/.vulkro/scans.db. Run it from CI or a daily job.
See also: Compliance overview, vulkro scan