Skip to main content

Find vulnerabilities. Close them before attackers do.

Vulkro reads your application's code, packages, secrets and APIs. It finds the vulnerabilities an attacker can actually reach, and shows the attack path step by step. It checks Salesforce orgs too.

Start a 14-day trial

From $20 a month. 14-day trial, $0 today. See pricing
Not ready for a trial? Open a sample report first.

  • Claude Code
  • Cursor
  • Codex
  • GitHub Copilot
  • Windsurf
  • Gemini CLI
  • Cline
  • Amp
  • Kilo Code
  • OpenCode
  • VS Code
  • VSCodium
  • Neovim
  • Helix
  • Emacs
  • Zed
  • Terminal
  • iTerm2
  • Warp
  • Ghostty
  • Pull requests
  • GitHub Actions
  • GitLab
  • Jenkins
  • + any other MCP client
  • + more

Teams shipping with Vulkro, in the tools they already use.

01The problem

A list of findings is not a plan.

Most tools hand you a long list where everything looks equally urgent. An attacker only needs the one that leads somewhere.

What most tools give you

  • Password left in the codeMedium
  • Old encryptionLow
  • Missing security settingLow
  • Unsafe database queryHigh
  • Outdated libraryMedium
  • Debug mode left onLow
  • Sharing setting too openMedium

…and hundreds more like it.

  1. Unauthenticated user
  2. Customer data
One finding leads somewhere. Vulkro shows which.

02The attack path

Follow the path, not the list.

An attack path is the chain of steps from an entry point, such as a public page, to a sensitive asset. For the issues Vulkro can trace, it shows who could gain access, how, and what data they would reach.

High riskConfirmed
  1. WhoUnauthenticated userNo login needed
  2. Way inThe search boxOn your public website
  3. VulnerabilityUnvalidated searchSent straight to your database
  4. What happensDatabase obeysRuns it as a command, not a search
  5. What they getCustomer recordsNames, emails and orders
Fix

Vulkro points to the one line to change. Your agent or your team fixes it, and Vulkro verifies the fix.SQL injection · js-taint-sql-001

Vulkro Core

See it before you start a trial

  • Sample report Vulkro Cloud on Ledgerline, a made-up invoicing app with vulnerabilities planted on purpose, and on a made-up Salesforce org: the attack paths, the issues, the graphs and the org posture, read-only. The executive report is there to download.
  • Sample SARIF The same scan as the standard results file your code host and CI tools read.
  • vulkro demoInstall Vulkro and run the demo: it scans a small vulnerable project that ships with Vulkro, and it needs no licence.

The workspace holds fictional data. The report and the SARIF are unedited output of vulkro 0.40.0 from 2026-11-02, with only the folder paths of the machine that ran the scan removed.

Find the paths in your own code or org.

Start a 14-day trial

$0 today. No charge for 14 days. Cancel any time.

03Products

One engine, wherever you work.

Use it in your editor, on your laptop, with your AI coding assistant or in Vulkro Cloud. Same checks, same answers everywhere.

Using an AI coding assistant?
  1. Public page
  2. Leaked secret
  3. Risky package
  4. Open API endpoint
  5. Customer data
A scan of your code: one route from a public page reaches the customer data.
Application codeVulkro Core Checks your app's code and shows which vulnerabilities an attacker can actually reach.
  1. Public page
  2. Guest user
  3. Sharing rule
  4. Apex code
  5. Customer data
A public page leads through a guest user and a sharing rule to customer data.
SalesforceVulkro for Salesforce Checks your Salesforce code and your org's settings and permissions, where most of the risk hides.
  1. Repositories and Salesforce orgs
  2. One workspace
  3. Scheduled scans
  4. One issue list for the team
Repositories and Salesforce orgs scanned in one workspace, with one issue list for the team.
For teams14-day trial, set up for youVulkro Cloud Enterprise security for code and Salesforce. Your code repositories and Salesforce orgs in one workspace: pull-request checks, release gates, attack paths and reports for the whole team.
In the editorVS Code extension Flags the problem on the line that causes it, while you write it.

04The product

This is what you work in.

Vulkro and Vulkro Cloud: what is wrong, how an attacker could exploit it, who owns the fix, and what to do first.

The riskiest problems in your code first. Proven means every step of the path was traced in your code.

05Why Vulkro

Ranked by what an attacker can reach.

How we measured
  1. 01The path, not the listSee how someone would actually break in, so you fix what matters first.Shown for every problem Vulkro can trace
  2. 02Looks deep, not just on the surfaceFollows your data across files in JavaScript, TypeScript, Python, Go and Java, and through settings and permissions.216 of 229 planted vulnerabilities found in blind tests (vulkro 0.41.0, 2026-11-02)
  3. 03On your machine, or in Vulkro CloudScan on your machine and your code stays with you, or in Vulkro Cloud for your team. Detection uses no AI, so the same code always gets the same answer.The scanner runs offline, air-gapped included
  4. 0466% fewer AI tokensYour AI coding assistant gets the findings from Vulkro in one call: as many real issues in total (238 of 280) found, a 59% lower bill.Against an AI agent reading the code itself. Measured with vulkro 0.32.0 on 2026-10-07, on Vulkro's own test apps, which were used to develop Vulkro, so the result is flattered.

06Pricing

The full product, on every plan.

Every plan starts with a 14-day trial. $0 today, and you can cancel any time before it ends.

Compare plans

Every Pro plan also includes Cloud scans in your portal (1 a month); an upgrade adds daily scans or more. See Cloud scans

For a team: Vulkro Cloud workspaces from $149 a month, set up for you with a 14-day trial. See team plans

07From the blog

Research and guides.

See what an attacker could reach in your own app.

Start a 14-day trialTalk to us