Accounts and licensing

Vulkro requires a verified account before it can scan. Your first CLI sign-in starts a 14-day trial of the full product. After the trial, licenses are issued directly by our team; email [email protected]. There is no self-serve checkout.

Scanning always runs locally: your code and your findings never leave the machine. The only thing the account layer moves over the network is a short device token and anonymous usage counters (see Telemetry).

What the account gates

Without a valid signed lease (from vulkro login) or an installed .lic file (from vulkro activate), a scan stops with an actionable message and exit code 1. The account and license commands on this page keep working even while scanning is blocked, so you can always recover: vulkro login, vulkro account, vulkro license-status, vulkro logout, and vulkro activate.

The 14-day trial is a trial of the full product, so a new user scans every supported language (including Java and Spring) from day one. See Languages and coverage for the tier split.

Sign in: vulkro login

There are three ways in, tried in this order:

vulkro login                    # browser login (default)
vulkro login --code ABCD-1234   # paste a pairing code, no browser
VULKRO_ACCOUNT_TOKEN=... vulkro login   # CI / headless, no browser

• Browser login (vulkro login, no arguments) prints a short code (for example ABCD-1234), opens your default browser to the account console, and waits while you approve that code in a logged-in tab. If a browser cannot be opened, it prints the URL to open by hand. Approval assigns a seat and installs the lease. The wait is bounded (about 15 minutes); a denied, expired, or timed-out login exits 2 and changes nothing.
• Pairing code (vulkro login --code <CODE>) pastes a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
• CI / headless: set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro login with no --code. It exchanges the token for a lease with no browser and no code.

All three paths install the same signed subscription lease. Exit codes: 0 logged in and lease installed; 2 error (offline, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

The lease and offline grace

Pairing installs a short-lived signed subscription lease that unlocks the scanner exactly like a .lic file. The scan path is unchanged and still runs fully offline against the cached lease.

• The lease refreshes automatically once a day while online (the daily entitlement ping).
• It stays valid fully offline through its signed expiry (about 14 days), so short offline stretches (travel, flaky networks) never interrupt work mid-lease.
• Once the signed expiry passes without a refresh, scanning pauses until the machine can refresh, you log in again, or you activate a .lic.

The refresh call carries only this device's token and anonymous usage counters: never your code, your findings, or your machine fingerprint.

After the trial

When the trial lapses, request a license from the Vulkro team at [email protected]. Vulkro is licensed per seat, directly through our team. vulkro buy opens a pre-filled request email with this machine's fingerprint and your days-of-use stats; the team replies with a .lic file you install with vulkro activate.

Check your state: vulkro account and vulkro license-status

vulkro account          # local view: tier, seat, expiry, offline grace
vulkro license-status   # sign-in status, tier, expiry, machine ID, features

• vulkro account is 100% local: it reads only your local database and makes no network call, so it works air-gapped. It shows your tier on the ladder Free, Pro, Team, Enterprise; your seat (for example "seat 2 of 5"); the lease expiry; and the offline-grace remaining. Exit codes: 0 printed, 2 local read error.
• vulkro license-status shows the current license state and the per-feature checklist, and keeps working while scanning is blocked. Exit codes: 0 printed, 2 local database error.

Sign out: vulkro logout

vulkro logout

Deletes the local device token and cached lease, then makes a best-effort revoke call to the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro activate is left untouched and keeps working. Scanning then requires signing in again. Exit codes: 0 logged out (or nothing to do), 2 local database error.

Air-gapped and offline machines

Machines that cannot reach the public internet use a license file instead of vulkro login:

vulkro activate ./your-team.lic   # install a signed .lic (replaces login)
vulkro machine-id                 # print this machine's fingerprint

vulkro activate verifies the Ed25519 signature, checks the machine binding, and stores the key locally. Print the machine fingerprint with vulkro machine-id when requesting a license file. See Offline mode for the full air-gap workflow.

With VULKRO_OFFLINE=1 set, vulkro login and vulkro logout refuse (no outbound call) and point you at the .lic path; vulkro account still works.

Environment variables

Variable	Effect
VULKRO_ACCOUNT_URL	Override the account / API base. Defaults to https://api.vulkro.com. Useful for self-hosting or testing.
VULKRO_ACCOUNT_TOKEN	Supply a device token non-interactively so vulkro login (with no --code) can pair a headless / CI machine without the browser flow.
VULKRO_OFFLINE=1	The air-gap switch. Disables login, the lease refresh, and every other outbound call, guaranteeing zero egress.

What's next

• Install -> - get the binary.
• Your first scan -> - point Vulkro at a project.
• Telemetry -> - exactly what the heartbeat sends.
• Offline mode -> - the air-gapped workflow.