Accounts and licensing

Vulkro needs a verified account before it can scan. Your first CLI sign-in starts a 14-day trial of the full product. After the trial, our team issues licenses directly: email [email protected]. There is no self-serve checkout.

Scanning always runs on your machine. Your code and your findings never leave it. The account layer sends only a short device token and anonymous usage counters over the network (see Telemetry).

What the account gates

Without a valid signed lease (from vulkro login) or an installed .lic file (from vulkro activate), a scan stops with a clear message and exit code 1.

You can always recover, because the account and license commands keep working even while scanning is blocked: vulkro login, vulkro account, vulkro license-status, vulkro logout, and vulkro activate.

The trial is the full product, so from day one you can scan every supported language, including Java and Spring. See Languages and coverage for the tier split.

Sign in: vulkro login

There are three ways in, tried in this order:

vulkro login                    # browser login (default)
vulkro login --code ABCD-1234   # paste a pairing code, no browser
VULKRO_ACCOUNT_TOKEN=... vulkro login   # CI / headless, no browser

• Browser login (vulkro login, no arguments). Vulkro prints a short code (for example ABCD-1234) and opens your browser to the account console. Approve the code in a logged-in tab and the lease installs. If no browser can open, it prints the URL to open by hand. The wait is bounded (about 15 minutes). A denied, expired, or timed-out login exits 2 and changes nothing.
• Pairing code (vulkro login --code <CODE>). Paste a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
• CI / headless. Set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro login with no --code. It swaps the token for a lease, with no browser and no code.

All three install the same signed subscription lease. Exit codes: 0 logged in and lease installed; 2 error (offline, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

The lease and offline grace

Login installs a short-lived signed lease that unlocks the scanner just like a .lic file. The scan itself is unchanged and still runs fully offline against the cached lease.

• The lease refreshes automatically once a day while online.
• It stays valid offline through its signed expiry (about 14 days), so short offline stretches (travel, flaky networks) never interrupt work.
• Once that expiry passes without a refresh, scanning pauses until the machine can refresh, you log in again, or you activate a .lic.

The refresh call carries only this device's token and anonymous usage counters. Never your code, your findings, or your machine fingerprint.

After the trial

When the trial lapses, request a license from the Vulkro team at [email protected]. Vulkro is licensed per seat, directly through our team. vulkro buy opens a pre-filled request email with this machine's fingerprint and your days-of-use stats. The team replies with a .lic file you install using vulkro activate.

Check your state: vulkro account and vulkro license-status

vulkro account          # local view: tier, seat, expiry, offline grace
vulkro license-status   # sign-in status, tier, expiry, machine ID, features

• vulkro account is fully local. It reads only your local database and makes no network call, so it works air-gapped. It shows your tier (Free, Pro, Team, Enterprise), your seat (for example "seat 2 of 5"), the lease expiry, and the offline grace remaining. Exit codes: 0 printed, 2 local read error.
• vulkro license-status shows the current license state and the per-feature checklist, and keeps working while scanning is blocked. Exit codes: 0 printed, 2 local database error.

Sign out: vulkro logout

vulkro logout

This deletes the local device token and cached lease, then tries to revoke the seat on the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro activate is left untouched and keeps working. After logout, scanning needs a fresh sign-in. Exit codes: 0 logged out (or nothing to do), 2 local database error.

Air-gapped and offline machines

Machines that cannot reach the internet use a license file instead of vulkro login:

vulkro activate ./your-team.lic   # install a signed .lic (replaces login)
vulkro machine-id                 # print this machine's fingerprint

vulkro activate verifies the Ed25519 signature, checks the machine binding, and stores the key locally. Run vulkro machine-id to get the fingerprint to send when requesting a license file. See Offline mode for the full air-gap workflow.

With VULKRO_OFFLINE=1 set, vulkro login and vulkro logout refuse to run (no outbound call) and point you at the .lic path. vulkro account still works.

Environment variables

Variable	Effect
VULKRO_ACCOUNT_URL	Override the account / API base. Defaults to https://api.vulkro.com. Useful for self-hosting or testing.
VULKRO_ACCOUNT_TOKEN	Supply a device token non-interactively so vulkro login (with no --code) can pair a headless / CI machine without the browser flow.
VULKRO_OFFLINE=1	The air-gap switch. Disables login, the lease refresh, and every other outbound call, guaranteeing zero egress.

What's next

• Install -> - get the binary.
• Your first scan -> - point Vulkro at a project.
• Telemetry -> - exactly what the heartbeat sends.
• Offline mode -> - the air-gapped workflow.