Skip to main content

vulkro demo

Scan a bundled, deliberately vulnerable project. A first run always ends with a real finding, its proof and its fix on screen, instead of an empty table on a codebase that happens to be clean.

Nothing is uploaded and no account is needed: the demo project ships inside the binary and the scan runs on your machine like any other.

Usage​

vulkro demo

Read the output the way you would read a real scan: the severity counts, then each finding with the data-flow hops behind it. Every finding in the demo is proven, so it is a good place to see what the proof looks like before you point the scanner at your own repository.

Then your own code​

cd path/to/your/project
vulkro scan .

See Your first scan for how to read the result and cut it down to what matters.

Command reference​

Generated from vulkro help demo on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Scan a bundled, deliberately vulnerable project so a first run always shows a real finding.

Points Vulkro at a small, deliberately vulnerable project so a first run always shows real findings, even when your own code is clean. It writes a small deliberately vulnerable project to a temporary directory, scans it exactly as `vulkro scan` would, and prints the findings with their proof.

Free, offline, and no account needed: it runs the same analysis as a normal scan, on code shipped with Vulkro.

Exit codes: `0` the demo scan ran. Findings ARE expected here and are the point, so a finding is not a failure and does not exit 1. `2` error: the temporary project could not be written or scanned.

Usage: vulkro demo [OPTIONS]

Options:
      --keep
          Keep the generated project and print its path instead of deleting it, so the code behind each finding can be read and edited

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')
Last updated on