Skip to main content

Licensing Vulkro for Salesforce

Vulkro for Salesforce scans on the Free tier with no account: every language and every code check, with findings, their proof and the fix. An account holds Pro. Your first CLI sign-in with vulkro-sf login starts a 14-day trial of the full product. After the trial, licences are issued directly by our team; email license@vulkro.com. There is no online checkout today.

Air-gapped orgs that cannot reach the public internet use a signed, machine-bound .lic file instead of vulkro-sf login. A .lic you install with vulkro-sf activate unlocks Pro fully offline, and existing .lic keys keep working exactly as before.

Scanning with vulkro-sf always runs locally: your code, metadata, and customer records never leave the machine. (Vulkro Cloud, the hosted workspace, is a separate service that scans the orgs you connect to it; see Vulkro Cloud.) The only thing the account layer moves over the network is a short device token and anonymous usage counters.

This is separate from the general vulkro scanner. The two are licensed independently: a vulkro-sf account or key is a different product from a core vulkro account or key, and neither one substitutes for the other.

What the account gates​

Without a valid signed lease (from vulkro-sf login) or an installed .lic file (from vulkro-sf activate), vulkro-sf runs on the Free tier and keeps scanning source and metadata. Pro adds capabilities such as the live-org audit, the AppExchange report, Salesforce compliance packs and the presubmit gate; a Free run lists what is locked, and vulkro-sf license-status shows the full list. A licence with an invalid signature, or a detected clock rollback, still stops a scan with exit code 1.

The 14-day trial is the full product: a new user runs every detector, the AppExchange readiness report, and the live-org audit from day one.

Sign in: vulkro-sf login​

Log in and pair this device with your Vulkro account, then install the returned subscription lease. Three ways in, tried in this order:

vulkro-sf login                    # browser login (default): shows a code, opens your browser
vulkro-sf login --code ABCD-1234   # paste a pairing code from app.vulkro.com/connect
VULKRO_ACCOUNT_TOKEN=... vulkro-sf login   # CI / headless: exchange a stored device token
  • Browser login (vulkro-sf login, no arguments) prints a short code (for example ABCD-1234), opens your default browser to the account console, and waits while you approve that code in a logged-in tab. If a browser cannot be opened, it prints the URL to open by hand. Approval assigns a seat and installs the lease.
  • Pairing code (vulkro-sf login --code <CODE>) pastes a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
  • CI / headless: set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro-sf login with no --code. It exchanges the token for a lease with no browser and no code.

The lease refreshes automatically on the daily entitlement ping while online and stays valid fully offline through its signed expiry (about 14 days). The ping carries only anonymous usage counters plus this device's token: never your code, findings, or machine fingerprint.

Exit codes: 0 logged in and lease installed; 2 error (offline set, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

After the trial​

When the trial lapses, request a license from the Vulkro team at license@vulkro.com. Vulkro for Salesforce is licensed per seat, directly through our team. vulkro-sf buy opens a pre-filled request email with this machine's fingerprint. The team replies with a .lic file you install with vulkro-sf activate.

vulkro-sf account​

Show your Vulkro account: email, tier, seat (for example "seat 2 of 5"), expiry, offline-grace remaining, and last sync. 100% local: makes no network call and works air-gapped.

vulkro-sf account

Exit codes: 0 report printed; 2 local database read error.

vulkro-sf license-status​

Prints the current Vulkro for Salesforce license state on this machine: sign-in status, tier, expiry, machine ID, and the feature checklist: which Pro capabilities are locked or unlocked on this machine.

vulkro-sf license-status

Exit codes: 0 on success, 2 on error.

vulkro-sf logout​

Log out this device: delete the local device token and cached lease, then make a best-effort revoke call to the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro-sf activate is left untouched and keeps working.

vulkro-sf logout

Exit codes: 0 logged out (or nothing to do); 2 local database error.

Air-gapped: vulkro-sf machine-id, buy, and activate​

Machines that cannot reach the public internet use a license file instead of vulkro-sf login. Existing .lic customers (including AppExchange and VKSF keys) stay on this path with no change.

vulkro-sf machine-id​

Prints this machine's Vulkro fingerprint (32 hex characters). It is the same value the desktop console shows under Settings, License, "This machine's ID". Paste it into your license request so the .lic file the team mints is bound to this machine.

vulkro-sf machine-id

Exit codes: 0 on success, 2 on error.

vulkro-sf buy​

Opens a pre-filled license-request email with this machine's ID, or prints the address when running headless. You can also request a license directly from license@vulkro.com. The signed .lic file arrives by email.

vulkro-sf buy

Exit codes: 0 on success, 2 on error.

vulkro-sf activate​

Installs a .lic activation key. It verifies the Ed25519 signature and the machine binding, then stores the key locally, with no remote server in the loop. A vulkro-sf key is a separate product from a core vulkro key, so a core key does not unlock the Salesforce scanner and vice versa.

vulkro-sf activate ./vulkro-sf.lic

On an air-gapped machine, copy the .lic file across and run vulkro-sf activate <file.lic> there. Set VULKRO_SF_OFFLINE=1 to turn login, the lease refresh, and any other optional outbound call into a hard error; it does not affect the local activation flow, and vulkro-sf account still works.

Exit codes: 0 on success, 2 on error.

CI runners​

A CI runner signs in the same way a laptop does, or activates a .lic if the runner is offline. For a networked runner, set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro-sf login as the first step. For an air-gapped runner, request a key for the runner image's fingerprint, bake the .lic file into the image (or inject it as a secret at job start), and run vulkro-sf activate <file.lic> before the first scan. See CI/CD integration.

Where to go next​

Last updated on