VS Code security extension (also Cursor and Windsurf)
The VS Code extension shows Vulkro findings inline as you work, in VS Code, Cursor, Windsurf and VSCodium.
vulkro install-extension # Vulkro Core
vulkro-sf install-extension # Vulkro for Salesforce
It finds your editor even when code is not on your PATH. Flags: --yes, --editor <code|cursor|windsurf|codium>, --vsix <file> (a local package). VULKRO_VSIX_URL points it at a mirror.
The extension runs the vulkro binary, so install the scanner first.
Sign in
Run Vulkro: Sign in from the Command Palette and approve the code in your browser. It shares the licence of vulkro login. Needs an active trial or Pro (app.vulkro.com/billing). Air-gapped machines use Vulkro: Activate license file. Without a licence the status bar says so; it never shows empty results as if a file were clean.
What it does
- Findings in the editor. Open a JavaScript, TypeScript, Python, Go or Java file and findings appear in the gutter and the Problems panel. Hover one for the rule and fix advice.
- Quick fixes. The lightbulb offers Suppress (adds a
// vulkro:disable next-line <rule>comment), Explain, and for a few clear-cut patterns (weak hash,yaml.load, cookie flags, debug flags) a one-line fix. Fix issue with AI appears when you set up a local model. - Same results as CI. Vulkro: Export report saves SARIF or JSON from the same scan CI runs, and Vulkro: Verify editor / CI parity gives you the matching
vulkro scan . --min-severity <level>command.
For Salesforce projects the extension also starts vulkro-sf lsp for Apex, Aura, LWC, Visualforce, Flow and metadata. See the Salesforce extension page.
You stay in control of edits
The extension never edits a file on its own: every suppression or fix is applied only when you accept it. An AI fix is offered only after a fresh scan of the patched copy no longer reports the finding.
AI features are optional and use a local Ollama model by default, so nothing leaves your machine. Vulkro: Use editor AI model switches to your editor's model (for example GitHub Copilot), which sends prompts to its provider; it is refused under VULKRO_OFFLINE=1.
Performance
The first file you open gets a fast single-file scan, then a project scan runs in the background. A save re-scans only that file (or the project, for a cross-file finding). Typing never starts a scan.
Settings
| Setting | Default | What it does |
|---|---|---|
vulkro.path | vulkro | Path to the vulkro binary |
vulkro.severityThreshold | low | Lowest severity shown. Match it in CI with --min-severity |
vulkro.minConfidence | medium | Lowest confidence shown, like --min-confidence |
vulkro.saveScope | file | file re-scans the saved file; project re-scans everything on save |
vulkro.watch | false | Rescan as files change on disk |
vulkro.depth.deepScan | false | Add the slower, thorough passes to live scans |
vulkro.showAdvancedViews | false | Show Changes, History, Impact, Trends, Dependencies and more |
vulkro.checkForUpdates | true | Check once a day for a newer scanner or extension (skipped under VULKRO_OFFLINE=1) |
vulkro.ai.transport | local | local (Ollama) or editor (your editor's model) |
vulkro.ai.model | (empty) | Local model name; empty uses qwen2.5-coder:7b |
vulkro.ai.url | (empty) | Local model endpoint; empty uses http://127.0.0.1:11434/v1 |
Neovim, Helix and Emacs can run the language server directly: see vulkro lsp.