Install Vulkro for Salesforce
Vulkro for Salesforce is one binary, vulkro-sf, that scans Salesforce source and metadata on your machine.
curl -fsSL https://dist.vulkro.com/install-sf.sh | bash
vulkro-sf --version
On Windows, in PowerShell:
irm https://dist.vulkro.com/install-sf.ps1 | iex
The installer picks the build for your OS and CPU, verifies its SHA-256 checksum and installs to /usr/local/bin (or ~/.local/bin when that is not writable). On Windows it installs to %USERPROFILE%\.local\bin and adds it to your PATH. Inside WSL, use the macOS and Linux command.
Installer options
| Option | Environment variable | What it does |
|---|---|---|
--version <tag> (-Version on Windows) | VULKRO_SF_VERSION | Pin a release tag. Default: latest. |
--bin-dir <dir> (-BinDir on Windows) | VULKRO_SF_BIN_DIR | Install somewhere else. |
VULKRO_CDN | Download from your own mirror. |
VULKRO_VERSION and VULKRO_BIN_DIR are read when the VULKRO_SF_* variables are unset.
Start the trial and sign in
Scanning needs an active trial or Pro. Start the 14-day trial (card required) at app.vulkro.com/billing, or run vulkro-sf buy to open that page. Then sign in on this machine:
vulkro-sf login
Until you sign in, every scan exits 1 with vulkro-sf: license_required. Air-gapped machines install a licence file with vulkro-sf activate <file.lic> instead. See Licensing.
Scan
vulkro-sf scan ./force-app
See Your first scan for what the output means.
Optional: the Salesforce CLI
Source scans need nothing else. The live-org commands (vulkro-sf org ... and scan --org) read your org through your own sf CLI login:
npm install -g @salesforce/cli
sf org login web --alias my-prod
The OAuth token stays in the sf CLI. See Live-org setup.
Stay up to date
vulkro-sf update upgrades the binary and refreshes the signed vulnerability and rule data. A plain vulkro-sf scan never contacts the release feed. See vulkro-sf update.
See also: Your first scan, Live-org setup