vulkro review

Pro

vulkro review is part of Pro: Working-tree review (changes), the findings on the lines this change touched, as an inline diff. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Review the security findings on your git changes, like a code-review tool. vulkro review scans the tree, then shows only the findings that land on the lines this change touched, rendered as an inline diff. Each finding is tagged NEW (introduced by this change) or existing (already there on an unchanged line), so you see what you added and what was already there.

Usage

vulkro review [OPTIONS] [PATH]

Arguments

Argument	Description	Default
PATH	Path to the project root.	.

Scope selectors

Pick at most one. The default (no selector) reviews the working tree: uncommitted changes (git diff HEAD) plus untracked files.

Flag	Scope
--staged	Only staged changes (git diff --cached).
--last-commit	The most recent commit (HEAD~1..HEAD).
--commit <REV>	A single commit's own diff (<rev>^..<rev>).
--range <SPEC>	An arbitrary range: A..B, A...B (merge-base), or a bare <ref> (treated as <ref>..HEAD).

Flags

Flag	Description	Default
--baseline <REF>	Classify NEW vs existing precisely by scanning this base ref in a temporary worktree and comparing finding fingerprints. Slower, but it catches a finding whose meaning changed without its line moving. Without it, a finding on an added line is NEW and one on an unchanged context line is existing.
--fail-on <FAIL_ON>	Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of critical, high, medium, low, or none. none never gates.	low
--format <FORMAT>	human (default) or json.	human
--context <N>	Diff context lines to show around each change. Overrides VULKRO_REVIEW_CONTEXT.	3
--offline	Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1).

Environment variables

Variable	Effect
VULKRO_REVIEW_CONTEXT	Default diff context lines, overridden by --context. Default 3.

Exit codes

• 0 no NEW findings at or above --fail-on.
• 1 one or more NEW findings at or above --fail-on (the review is the report). Use --fail-on none for a report that never gates.
• 2 error: not a git repo, a bad ref, or a scan failure.

Examples

# Review the uncommitted working tree (the default).
vulkro review

# Review only what is staged, and gate on new High or above.
vulkro review --staged --fail-on high

# Review the most recent commit as JSON.
vulkro review --last-commit --format json

# Review a range against a precise baseline classification.
vulkro review --range origin/main...HEAD --baseline origin/main

Related

• vulkro gate - the canonical fail-on-new-only CI gate across the two full finding sets.
• vulkro diff - the per-finding surface delta vs a saved scan or git ref.
• vulkro scan - the full pipeline, including the --gate-vs changed-lines lane.

Command reference

Generated from vulkro help review on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Show the findings that sit on lines your git change touched, like a code review.

Review the security findings on your git changes: scan the tree, then show only the findings that land on the lines this change touched, rendered as an inline diff (the way a code-review tool shows issues on the lines you changed). Each finding is tagged NEW (introduced by this change) or existing (already there on an unchanged line).

Scope (pick at most one; default is the working tree): (default)       uncommitted changes: `git diff HEAD` + untracked files --staged        only staged changes: `git diff --cached` --last-commit   the most recent commit: HEAD~1..HEAD --commit <rev>  that commit's own diff: <rev>^..<rev> --range <spec>  A..B, A...B (merge-base), or a bare <ref> (since <ref>)

Environment variables: VULKRO_REVIEW_CONTEXT   Default diff context lines (overridden by --context). Default 3.

Exit codes: 0  no NEW findings at or above --fail-on. 1  one or more NEW findings at or above --fail-on (the review is the report). Use `--fail-on none` for a report that never gates. 2  error: not a git repo, bad ref, or scan failure.

Usage: vulkro review [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root. Defaults to the current directory
          
          [default: .]

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --staged
          Review only staged changes (`git diff --cached`)

      --last-commit
          Review the most recent commit (HEAD~1..HEAD)

      --commit <REV>
          Review a single commit's own diff (`<rev>^..<rev>`)

      --range <SPEC>
          Review an arbitrary range: `A..B`, `A...B` (merge-base), or a bare `<ref>` (treated as `<ref>..HEAD`)

      --format <FORMAT>
          Output format: `human` (default) or `json`
          
          [default: human]

      --context <N>
          Diff context lines to show around each change. Overrides VULKRO_REVIEW_CONTEXT; defaults to 3

      --baseline <REF>
          Precise NEW-vs-existing classification by scanning the given base ref in a temporary worktree and comparing finding fingerprints (slower, but catches a finding whose meaning changed without its line moving). Without this, a finding on an added line is NEW and one on an unchanged context line is existing

      --fail-on <FAIL_ON>
          Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of `critical`, `high`, `medium`, `low`, or `none`. Default `low` (any real finding gates). `none` never gates
          
          [default: low]

  -h, --help
          Print help (see a summary with '-h')