Roles and home views
Built-in roles
| Role | What it can do |
|---|---|
| Owner | Everything, including deleting the workspace and changing who else is an owner. |
| Maintainer | Runs the workspace: members, roles, Workspace Settings, notifications and every org. Everything except deleting the workspace and changing owners. |
| Org Admin | Runs the orgs they are given: connects and configures them, runs scans, exports reports and approves triage. Submits rule changes for approval. No Workspace Settings. |
| Security Analyst | Sees everything in their orgs; runs scans and exports reports. No Workspace Settings. |
| Developer Admin | The developer pages plus the org posture pages; runs scans; approves or rejects triage requests. |
| Developer | Code findings, code graph, impact, quality, issues and attack paths; submits triage for approval. |
| Auditor | Read-only: overview, issues, compliance, review readiness, licences and Activity. Can export. Changes nothing. |
| Viewer | Sees every module except Data, Identity & Access user details, notification destinations and Workspace Settings. Changes nothing. |
Viewers and Auditors are free seats on every plan, and so is a custom role based on either. Every other role counts toward the plan's paid members.
Custom roles
Make a custom role by copying a built-in role (any role except Owner), then set:
- Page access: None, View or Manage, for each page in the menu.
- Actions: Submit Triage for Approval, Approve Triage, Submit Rule Changes for Approval, Approve Rule Changes, Write Custom Rules, Connect vulkro-sf, and Allow Support Access.
Member scope
What a member can see is also limited by their scope, set per member in Members: every org and repository, a list of orgs and repositories, or a team. A team (Workspace Settings > Teams) groups orgs and repositories, and also narrows Issues, the home views, the Executive Report and dashboards to that team.
Home views
Each role opens on one of four home views. Admins set the view for each role in the Home View column of Workspace Settings > Roles, and the change is recorded in the activity log.
| View | For |
|---|---|
| Executive | Founders, executives and the board: risk and trend in plain words. |
| Security | Security leads: proven, exposed and overdue issues first. |
| Engineering | Developers and maintainers: the detailed view, with every page in the menu. |
| Compliance | Governance and auditors: readiness, failing controls and evidence. |
The defaults:
| Role | Home view |
|---|---|
| Owner | Executive |
| Maintainer | Engineering |
| Org Admin | Security |
| Security Analyst | Security |
| Developer Admin | Engineering |
| Developer | Engineering |
| Auditor | Compliance |
| Viewer | Executive |
The Executive, Security and Compliance views use a short menu (Home, Issues, Orgs or Repositories, and Reports); Engineering keeps the full menu. A home view changes the home page, the menu and the first Issues view a member sees. It never changes what a member is allowed to see: that comes from the role and the scope.
Sign-in controls
In Workspace Settings > Sign-In & Security:
- Multi-Factor Authentication: require it for every member.
- Allowed Email Domains: only addresses at these domains can join.
- Session Timeout: an idle timeout (15 minutes to 7 days) and an absolute one (1 hour to 30 days).
- IP Allowlist: up to 100 address ranges. It applies to API tokens too.
- Single Sign-On (SAML or OIDC): on the Business plan and up, set up by our team on request.
Every change in the workspace is recorded in the activity log. Exporting the activity log is on the Business plan and up.