Blog
Security articles on application code, Salesforce orgs and AI coding agents.
How orgs and applications actually get attacked, how attack paths are built, and how to get more security analysis done with fewer tokens. RSS
Supply chain6 Oct 20269 min readThe npm worms of 2026Self-replicating npm worms returned in 2026 through preinstall hooks, a binding.gyp file and a hijacked CI pipeline. What they did and what slows the next one.Read the post →Application security5 Oct 20267 min readA clean scan that did not read your code is not a clean scanZero findings can mean the code is fine, or that the scanner never read it. Why silent coverage gaps happen, and how Vulkro reports what a scan did not analyse.Read the post →Compliance5 Oct 20268 min readPCI DSS 4.0 requirement 6: code review evidence that holds upPCI DSS 4.0 requirement 6 for engineers: 6.2.3 code review, 6.2.4 attack prevention, 6.3.2 inventory, and what automated scanning can and cannot evidence.Read the post →Developer workflow5 Oct 20268 min readWhy did the scanner not flag this?A pen tester finds a bug the scanner missed, and nobody can say why. vulkro why-not explains silence at a file and line: not read, unreachable, guarded or hidden.Read the post →Research5 Oct 20269 min readEU law now expects proof: why security tooling is no longer optionalThe CRA, NIS2, DORA, the new Product Liability Directive and the AI Act share one demand: show your security works, and keep showing it. What that means in 2026.Read the post →Attack paths4 Oct 20263 min readWhy attack paths matter more than lists of findingsA list of 400 Salesforce findings does not say which one matters most. An attack path does. How identity, permissions, code and data connect into one path an attacker can follow.Read the post →Salesforce4 Oct 202610 min readHow Salesforce orgs get breached, shown as attack pathsThe large Salesforce data thefts of 2025 and 2026 needed no platform flaw. Three identity-based attack paths were enough. Each one hop by hop, and where to stop it.Read the post →Salesforce4 Oct 20268 min readNIS2 and DORA reach your Salesforce org: the evidence you now needSalesforce runs the platform. Under NIS2 and DORA, the access, integrations and code inside your org are your responsibility. The evidence that shows it.Read the post →Developer workflow4 Oct 20266 min readSecurity where Salesforce developers write codeSecurity feedback for Apex, LWC, Aura, Visualforce and Flow usually arrives late, when a fix costs more. What it looks like in the editor, from diagnostics to runs-as.Read the post →Salesforce3 Oct 20269 min readConnected apps and OAuth tokens: the integration attack surfaceStolen and phished OAuth tokens drove the 2025 and 2026 Salesforce data thefts. What decides a token's reach, and a practical connected app review checklist.Read the post →Salesforce3 Oct 20263 min readIntroducing Vulkro CloudA hosted, read-only, scan-based workspace that scans every Salesforce org on a schedule, with attack paths, a Fix first list and the changes between scans.Read the post →Salesforce3 Oct 202610 min readSalesforce security in 2026 so farMass scanning of public sites in March, a stolen integration token in June. What was confirmed in 2026, what was only claimed, and what to check in your own org now.Read the post →