Your first scan

This page shows you how to run a scan, read the results, and cut them down to what matters.

First, connect the CLI to your account (this starts your 14-day trial):

vulkro login

Then point Vulkro at any project:

cd path/to/your/project
vulkro scan .

The scan runs entirely on your machine. A mid-sized project takes about 30 to 90 seconds.

What happens during a scan

Vulkro walks your project (respecting .gitignore), detects the language and framework, finds every HTTP route, and then checks for vulnerabilities, secrets, and known CVEs. It prints a summary when it is done.

Python, JavaScript, TypeScript, and Go are covered on every tier. Java with Spring Boot support is included in the trial and Pro. See Languages and coverage.

Read the output

A run looks like this:

 Detected: TypeScript | Next.js (App Router)
 224 endpoints | 2,230 modules

CRITICAL  33   HIGH  355   MED  1369   LOW  1063

API1 BrokenObjectLevelAuth         115 findings
API8 SecurityMisconfiguration     2292 findings
SECRETS                            436 hardcoded | 19 in git history
DEPS                                23 CVEs (4 KEV-listed, 7 reachable)

Completed in 42s | exit 1 (Critical/High present)

Here is what each part means:

• The severity counts are the headline. Critical and High stop a build by default.
• The OWASP categories show where your risk is concentrated.
• SECRETS covers both your current code and your git history.
• DEPS flags the most dangerous CVEs first: KEV-listed means "known to be exploited in the wild," and reachable means the vulnerable code is actually called from your project.

See the details

The default output is a summary. To see file names and line numbers:

vulkro scan . --verbose

For machine-readable output:

vulkro scan . --format json   | jq .findings[0]
vulkro scan . --format sarif  > vulkro.sarif

See Output formats for the full list (SARIF, SBOM, GDPR reports, CSV, PDF, and more).

Cut the noise

By default Vulkro shows Medium and High findings. You can adjust that:

# Default: the day-to-day mode.
vulkro scan .

# Strictest and most precise. Best for a build that blocks merges.
vulkro scan . --min-confidence high

# Show everything, including low-confidence, pattern-only findings.
vulkro scan . --all-confidence

# Skip non-source files (Dockerfiles, lockfiles, .tf, templates).
vulkro scan . --scope src

Silence a specific finding

Add a comment right in the code, no config file needed:

// vulkro:disable next-line API2
app.get("/internal/ping", noAuth);

// vulkro:disable-file at the top of a file silences all findings for that file. Every scan reports how many findings were suppressed, so nothing hides silently. See the suppressions guide.

Save the run

vulkro scan . --save

Saving keeps the run in your local history so you can compare against a previous scan (vulkro diff <ref>), track trends over time, or use it as a baseline to gate pull requests.

What's next

• Add Vulkro to CI -> - exit codes, PR comments, and SARIF upload.
• Open the desktop console -> - vulkro serve for triage.
• Understand the findings -> - what each check means.