Attack-path graph

An attack path is the chain of calls from an entry point (an API route, CLI handler, queue consumer or cron job) to a risky operation such as a SQL query, shell call or payment API.

vulkro serve                              # local console: Attack paths page
vulkro dataflow . --reaching-sink         # the same flows on the command line

What each path shows

Field	Meaning
Entry	The route (method and path) or handler name where data enters.
Reaches	The kind of flaw at the end of the path, for example SQL injection or path traversal, taken from the finding's rule and CWE (or its OWASP API category).
Hops	Each (file, function, line) step from entry to sink.
Severity	The worst finding at the sink. A code-quality finding never raises a path above Medium.

Use it to answer "which routes can reach stripe.charges.create?", to spot paths that skip an authorization check, and to walk a new engineer through how requests flow.

Vulkro Cloud shows the same attack paths, with the same Reaches wording, for every code repository in a workspace. vulkro dataflow also writes JSON, Mermaid, DOT or Markdown (--format); see vulkro dataflow.

Reverse reach

Reverse reach works the other way: given a finding's file and line, it walks the call graph backward and lists every entry point that reaches it. In the local console, open a finding and select the Entry Points tab.

Each result is an entry point with its hops, for example:

POST /api/charge
  routes/charge.py      handle_charge   line 11
  services/billing.py   submit          line 25
  services/db.py        execute_q       line 40

The search stops at 10 hops and 64 paths per target; the tab says so when it hits the limit. No path means the code is either an entry point itself, dead code, or reached only through dynamic dispatch the call graph does not follow.

See also: Bruteforce sinks, Taint analysis