vulkro dataflow
Document data flows. For every input surface (REST endpoints plus events),
vulkro dataflow traces the functions and classes the data passes
through, the sinks and stores it reaches, and how it is protected
(sanitisers) or classified (PII). The result is a connected graph you can
render as Mermaid, DOT, or JSON, or as a Markdown document.
By default every input surface is documented ("all flows"); the filter
flags below narrow the view. This command documents rather than gates, so
it never exits 1.
Usage
vulkro dataflow [PATH]
| Argument | Description | Default |
|---|---|---|
PATH | Path to the project root. | . |
Flags
| Flag | Description |
|---|---|
--format, -f <FORMAT> | table (default), json, mermaid, dot, markdown. The console Data flow map reads the json form. |
--reaching-sink | Only document flows that reach at least one security-relevant sink. |
--sensitive | Only document flows that carry classified (PII) data. |
--min-severity <SEV> | Only document flows whose worst reached sink is at least this severe: critical, high, medium, low, info. |
--source <SUBSTR> | Only document flows whose input-surface label contains this substring (case-insensitive), for example --source /users. |
--no-cache | Bypass the per-file extraction cache. |
--force-app | Bypass the framework self-scan heuristic (see vulkro discover). |
--force-all-rules | Bypass the posture-based rule-applicability gate. |
Output formats
| Format | Use |
|---|---|
table | Human-readable summary, one row per input surface. |
json | Structured nodes + edges + flows. The desktop console graph reads this. |
mermaid | Mermaid flowchart LR source, paste into a Markdown doc. |
dot | Graphviz DOT source. |
markdown | One documentation section per input surface. |
Exit codes
0success.2argument error or internal failure.
Exit 1 is not used: dataflow documents, it does not gate.
Examples
# Human summary of every input surface.
vulkro dataflow .
# Only flows that reach a High-or-worse sink, as Mermaid.
vulkro dataflow . --reaching-sink --min-severity high --format mermaid
# Only PII-carrying flows from the /users surface, as JSON.
vulkro dataflow . --sensitive --source /users --format json > flows.json
Related
vulkro discover- the endpoint map without flow tracing.vulkro scan- the full security pipeline.- Desktop console - the Data flow map tab.
- Taint analysis - source-to-sink tracking.