Vulkro Cloud

Enterprise security for code and Salesforce. Vulkro Cloud is the hosted Vulkro workspace for teams. You connect your code repositories and your Salesforce orgs, Vulkro Cloud scans them on a schedule with the same engine as the vulkro and vulkro-sf scanners, and your team works one shared list of issues.

Scan on your machine, or in Vulkro Cloud. The CLI, the VS Code extension and the local console keep scanning on your own machine, and your code stays there. Vulkro Cloud is the hosted option: it scans each connected repository or org in its own isolated container. Nothing reaches Vulkro Cloud unless you connect it.

Getting a workspace

Workspaces are set up by our team. Request access: it takes about two minutes, and we reply within two business days. A new workspace starts with a 14-day trial of the Team plan, with both apps. Questions: license@vulkro.com.

Each company gets its own workspace at https://<name>.vulkro.com, with its own database, storage and encryption key. See Data handling.

Two apps, one workspace

Switch between the apps from the app launcher (the nine-dot menu). Every Cloud plan includes both.

• Salesforce: org posture, access, attack paths and Apex code. Connect production orgs and sandboxes read-only; Vulkro Cloud never changes an org. See Connect Salesforce orgs.
• Core: code repositories, branches and quality gates. Connect GitHub, GitLab, Bitbucket or another git host with an access token. See Connect repositories.

What a code repository shows

Each connected repository has these areas, built from its latest scan:

Area	What it shows
API & Access	Endpoints, API Spec (which endpoints your OpenAPI specification documents, and which it misses), Access Matrix, Protocols
Data Flow	Data Flow, Data Lineage
Database	Tables, Columns and a Relationships diagram, read from your ORM models and migrations (see Database schema)
Code Map	Structure Map, Imports, Impact, Files
Secrets	Secrets in the code and in the git history
Dependencies	Dependencies, Vulnerabilities, Licences
Code Health	Hotspots, Test Coverage, Rules
Attack Paths	Paths from an entry point to a flaw, with the kind of flaw named

Some areas depend on the plan: attack paths are on Team and up.

The workspace layer

These work across both apps:

• Issues. One list per org or repository, kept across scans. Each issue has a key, a status, an assignee, an owner and a fix deadline. A scan that no longer finds an issue closes it; if it comes back, it is reopened.
• Combined Risks. One issue for each entry point where several weaknesses combine into a bigger risk.
• Triage with approval. Anyone with the right can mark an issue in progress or fixed. A false positive or an accepted risk waits for an approver.
• Ownership. Owners come from CODEOWNERS for code and from the last person who changed a component in Salesforce. Teams, and auto-assign rules by repository, path, risk or severity.
• Live dependency checks. Dependencies are checked against newly published advisories at every scan and once a day between scans, without a rescan. See Data handling for what that sends.
• Dependency search. Find where you use a package, a version range, an advisory or a licence across every repository.
• Home views per role. Executive, Security, Engineering and Compliance. See Roles and home views.
• Notifications and Jira. See Notifications and Jira.
• Reports and evidence. See Reports and evidence.
• API. See API and tokens.
• Sign-in controls. Require multi-factor authentication, allowed email domains, session timeouts and an IP allowlist, with an activity log of every change. Single sign-on is on the Business plan and up and is set up by our team.

From the terminal and your AI coding agent

Connect vulkro-sf to your workspace once, approving it in the browser:

vulkro-sf cloud connect https://<name>.vulkro.com

Then list what to fix, triage, fix and verify from the terminal, or let your AI coding agent do it through the sf_cloud_* MCP tools. See vulkro-sf cloud and vulkro-sf mcp serve. For scripts and CI, use a workspace API token: see API and tokens.

Run it on your own servers

Vulkro Cloud can also run on your own infrastructure. Talk to us: see On your own servers.