What is Vulkro?
Vulkro is a security scanner that runs on your own machine. Point it at your code and it finds the bugs that turn into breaches: the missing access check, the query a user can rewrite, the password left in the source, and the known vulnerabilities hiding in your dependencies. It reads your code without running it, and nothing ever leaves your computer.
It is one binary. There is no server to stand up, no database to configure, and nothing for your app to install at runtime.
In one minute
- Local. Every scan runs on your machine. Your code is never uploaded.
- Repeatable. The same code gives the same result every time. No AI sits in the scan, so a scan today matches a scan tomorrow.
- Built for CI. It can stop a build when it finds something serious, and it explains why.
- Honest. It shows you the exact path a bug takes through your code, and we publish what it misses, not just what it catches.
What it checks
| It looks at | And finds |
|---|---|
| Your API | Every HTTP endpoint in your code, and which ones anyone can reach without logging in. |
| Common vulnerabilities | The OWASP API Top 10 plus 50+ specific checks: SQL injection, XSS, SSRF, IDOR, CSRF, command injection, mass assignment, weak crypto, and more. |
| Secrets | Passwords, API keys, and tokens left in your code, config, and git history. |
| Dependencies | Known CVEs in your packages, with the ones that actually reach your code flagged first. |
| Compliance | Audit-ready evidence mapped to SOC 2, PCI DSS, HIPAA, GDPR, ISO 27001, and more. |
Which languages it supports
- Full analysis, free: Python, JavaScript, TypeScript, and Go, including the popular frameworks (Express, Next.js, FastAPI, Django, gin, and others).
- Full analysis, trial and Pro: Java, with first-class Spring Boot support.
- Every other language: dependency (CVE) scanning from your lockfiles.
- Salesforce (Apex, LWC, Aura, Flow, Visualforce) is a separate product, Vulkro for Salesforce.
See Supported languages and frameworks for the full list.
Why it runs on your machine
Most scanners work the other way around: you upload your code to their cloud, and they send findings back. That is a non-starter for regulated teams, on-premise setups, and anything air-gapped. It also makes CI unreliable, since the version scanning your pull request today may not be the one that scanned it last week.
Vulkro is the opposite. One binary, everything local, and the same answer every run. Pull the network cable and it still works.
What it will not do
- It does not run your code. Every scan is static.
- It does not send your findings anywhere. It fetches a signed CVE bundle
on first run; turn that off with
VULKRO_OFFLINE=1. - It does not replace a human review. It catches a large share of what a reviewer would, in a fraction of the time.
- It does not pretend to be perfect. Our benchmark is public and reproducible, and we leave the misses in.
Words we use
Findings talk about entry points, untrusted data flow, sinks, proof tiers and
SBOMs. The glossary explains each one in a sentence,
and vulkro glossary <term> prints the same definition on the terminal.
Where to go next
- Install - one line, on macOS, Linux, or Windows.
- Run your first scan -
vulkro scan .and what the output means. - Add it to CI - copy-paste GitHub Actions, GitLab CI, and pre-commit setups.
- See the benchmark - how accurate it is, misses included.