Accounts and licensing

Vulkro scans without an account. Scanning, every language, every detector, findings with their proof, and the fix all work on the Free tier with no sign-in. An account is what holds Pro. Your first CLI sign-in on a device starts a 14-day trial of the full product. After that, Pro licences are issued directly by our team: email license@vulkro.com for a personal, team, offline or custom licence. There is no online checkout today.

The scanner always runs on your machine. Your code and your findings never leave it unless you choose to send something: vulkro publish sends a redacted summary (never source code), and a repository you connect to Vulkro Cloud is cloned and scanned in Vulkro Cloud instead of on your machine. The account layer sends only a short device token and anonymous usage counters over the network (see Telemetry).

What the account gates

Without a signed lease (from vulkro login) or an installed .lic file (from vulkro activate), Vulkro runs on the Free tier and keeps scanning. No language needs Pro: JavaScript, TypeScript, Python, Go, Java and Spring, PHP, C and C++ all scan on Free (see Languages and coverage). Pro adds the whole-application capabilities, such as attack paths, change review, the release gate, compliance packs and the evidence formats; a Free run that asks for one is told which capability it needs. vulkro license-status lists them.

Two states still stop a scan with exit code 1, because both mean something is wrong with the machine: a licence with an invalid signature, and a detected clock rollback.

Sign in: vulkro login

There are three ways in, tried in this order:

vulkro login                    # browser login (default)
vulkro login --code ABCD-1234   # paste a pairing code, no browser
VULKRO_ACCOUNT_TOKEN=... vulkro login   # CI / headless, no browser

• Browser login (vulkro login, no arguments). Vulkro prints a short code (for example ABCD-1234) and opens your browser to the account console. Approve the code in a logged-in tab and the lease installs. If no browser can open, it prints the URL to open by hand. The wait is bounded (about 15 minutes). A denied, expired, or timed-out login exits 2 and changes nothing.
• Pairing code (vulkro login --code <CODE>). Paste a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
• CI / headless. Set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro login with no --code. It swaps the token for a lease, with no browser and no code.

All three install the same signed subscription lease. Exit codes: 0 logged in and lease installed; 2 error (offline, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

The lease and offline grace

Login installs a short-lived signed lease that unlocks the scanner just like a .lic file. The scan itself is unchanged and still runs fully offline against the cached lease.

• The lease refreshes automatically once a day while online.
• It stays valid offline through its signed expiry (about 14 days), so short offline stretches (travel, flaky networks) never interrupt work.
• Once that expiry passes without a refresh, the machine drops to the Free tier and keeps scanning; Pro returns when the lease refreshes, you log in again, or you activate a .lic.

The refresh call carries only this device's token and anonymous usage counters. Never your code, your findings, or your machine fingerprint.

After the trial

When the trial lapses, the machine returns to the Free tier and keeps scanning. To keep Pro, ask our team for a licence: vulkro buy opens a pre-filled request email to license@vulkro.com with this machine's ID and your days-of-use stats, or you can write to that address directly. The team replies with the licence: sign in with vulkro login to pick it up, or, on an air-gapped machine, install the .lic file with vulkro activate.

Check your state: vulkro account and vulkro license-status

vulkro account          # local view: tier, seat, expiry, offline grace
vulkro license-status   # sign-in status, tier, expiry, machine ID, features

• vulkro account is fully local. It reads only your local database and makes no network call, so it works air-gapped. It shows your tier (Free, Pro, Team, Enterprise), your seat (for example "seat 2 of 5"), the lease expiry, and the offline grace remaining. Exit codes: 0 printed, 2 local read error.
• vulkro license-status shows the current license state and the per-feature checklist. Exit codes: 0 printed, 2 local database error.

Sign out: vulkro logout

vulkro logout

This deletes the local device token and cached lease, then tries to revoke the seat on the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro activate is left untouched and keeps working. After logout the device drops to the Free tier and keeps scanning; only the Pro capabilities need a fresh sign-in. Exit codes: 0 logged out (or nothing to do), 2 local database error.

Air-gapped and offline machines

Machines that cannot reach the internet use a license file instead of vulkro login:

vulkro activate ./your-team.lic   # install a signed .lic (replaces login)
vulkro machine-id                 # print this machine's fingerprint

vulkro activate verifies the Ed25519 signature, checks the machine binding, and stores the key locally. Run vulkro machine-id to get the fingerprint to send when requesting a license file. See Offline mode for the full air-gap workflow.

With VULKRO_OFFLINE=1 set, vulkro login and vulkro logout refuse to run (no outbound call) and point you at the .lic path. vulkro account still works.

Environment variables

Variable	Effect
VULKRO_ACCOUNT_URL	Override the account / API base. Defaults to https://api.vulkro.com. Useful for self-hosting or testing.
VULKRO_ACCOUNT_TOKEN	Supply a device token non-interactively so vulkro login (with no --code) can pair a headless / CI machine without the browser flow.
VULKRO_OFFLINE=1	The air-gap switch. Disables login, the lease refresh, and every other outbound call, guaranteeing zero egress.

What's next

• Install -> - get the binary.
• Your first scan -> - point Vulkro at a project.
• Telemetry -> - exactly what the heartbeat sends.
• Offline mode -> - the air-gapped workflow.