vulkro publish

Scans this repository and publishes its security posture to your organisation dashboard, so the people who do not open the code can see which repositories are covered, what is proven open, and which way the trend is moving.

vulkro publish --terms             # read what publishing sends, send nothing
vulkro publish --preview           # print the exact snapshot, send nothing
vulkro publish .                   # publish this repository
vulkro publish . --authoritative   # from CI, on the default branch
vulkro publish . --all             # every git repo under this folder
vulkro publish . --from-json scan.json   # reuse a scan you already ran

Before you start

Publishing is part of the paid organisation plan and needs three things:

• An organisation, and the right to publish to it. Any member who can publish may do so; only organisation admins can view the dashboard. Signing in with vulkro login is enough on your own machine: the device token is used automatically. For CI or any headless box, set VULKRO_ORG_TOKEN to an account API key, which takes precedence when both are present.
• Online mode. The dashboard is a network feature. A publish is refused under --offline or VULKRO_OFFLINE, deliberately and with an actionable error rather than silently doing nothing. Scanning itself stays fully offline; only publishing needs the network, and a fully air-gapped organisation is not supported.
• Accepting the terms. Run vulkro publish --terms once and read them. Publishing is how you accept them.

What publishing sends

Run vulkro publish --preview to print the exact snapshot for the repository in front of you before you ever send one. Nothing about what leaves your machine is a surprise.

A publish sends:

• the repository's git remote, and in a monorepo the sub-project path
• file and module names, API routes and endpoints, and handler names
• the file and line behind each finding, plus its rule, severity and disposition
• the data-flow and data-access maps, hotspots and the code-structure map
• your dependency inventory (package, version, ecosystem, and the CVE or GHSA identifiers against it)
• contributor names, with a one-way hash of each git email
• the branch name

A publish never sends:

• your source code, code snippets, or finding message bodies
• secret values or credentials
• raw email addresses
• the licensing machine id

Your source code never leaves your machine. What publishing uploads is a detailed map of the application, which is what makes the dashboard useful to a reviewer and is why it is opt-in and covered by a data-processing agreement.

Options

Flag	What it does
[PATH]	The repository to scan. Defaults to the current directory.
--org <ORG>	The organisation slug. Defaults to $VULKRO_ORG.
--authoritative	Mark the snapshot authoritative: publish from CI on the default branch. Without it the snapshot is local and feeds adoption only, so the dashboard's health and trend do not flap with whoever scanned last.
--preview	Print the exact snapshot that would be sent, and send nothing.
--terms	Print the publishing terms and exit.
--all	Publish every immediate git repository under this path, each to its own dashboard entry. Cannot be combined with --from-json.
--from-json <FILE>	Publish an existing scan instead of scanning again. Reads the JSON that vulkro scan --format json writes, so a console or a CI job can reuse a scan it already ran rather than scanning twice.
--offline	Hard-disables outbound network calls, which means a publish is refused. Useful only to prove a run sends nothing.

Environment

Variable	What it does
VULKRO_ORG_URL	The organisation server to publish to. Point it at your own host to self-host the dashboard.
VULKRO_ORG_TOKEN	The publish token that authenticates the machine.
VULKRO_ORG	The default organisation slug, so --org can be omitted.
VULKRO_ORG_NO_DEPS	Set to 1 to drop the per-package dependency inventory and keep only the advisory counts.
VULKRO_ORG_SCHEMA2	Set to 1 to publish the older, redacted schema-2 body instead of the full-detail one.
VULKRO_ORG_SCHEMA1	Set to 1 to publish the original, counts-only schema-1 body.
VULKRO_CVE_LIVE	Set to 1 to add a live public CVE lookup for fresher advisory data, at the cost of a network call per advisory. Otherwise the same offline CVE bundle a plain scan uses is used, so a publish runs at scan speed.
VULKRO_OFFLINE	Hard-disables the network. A publish is refused while it is set.

In CI

Publish from CI on the default branch so the dashboard's trend line is built from one authoritative source rather than from whoever scanned last:

export VULKRO_ORG=acme
export VULKRO_ORG_TOKEN="$VULKRO_PUBLISH_TOKEN"
vulkro publish . --authoritative

To avoid scanning twice in a pipeline that already scans, reuse the scan you ran:

vulkro scan . --format json > scan.json
vulkro publish . --from-json scan.json --authoritative

Exit codes

Code	Meaning
0	Published, or previewed with --preview / --terms.
1	The organisation plan does not cover this machine.
2	An error: bad arguments, no git remote, network failure, or a refusal because offline mode is on.

A publish reports no findings, so 1 never means "issues were found" here the way it does for vulkro scan.

Salesforce

vulkro-sf publish is the same command for a Salesforce build, with the same flags, the same environment and the same refusal under offline mode. Its snapshots are tagged as Salesforce, so one dashboard keeps the two products apart rather than mixing them into one number.

vulkro-sf publish --preview
vulkro-sf publish . --authoritative

vulkro org

vulkro org preview and vulkro org publish are the older, narrower form of the same path and still work. vulkro publish is the one to use: it carries the full-detail snapshot, --all, and --from-json.

See also

• vulkro scan for the scan itself, which needs no account and no network.
• vulkro fix, which accepts a --finding id taken straight from the dashboard.
• Offline mode for what runs with no network at all.