Telemetry and the install heartbeat
Vulkro scans run entirely on your machine: your code, your findings, and your scan history never leave it. The only thing the binary sends is a best-effort anonymous install heartbeat, and this page documents exactly what it contains and how to turn it off.
The heartbeat
Alongside the version check, Vulkro sends an anonymous heartbeat at most
once per 24 hours (debounced by a timestamp file under ~/.vulkro). It
runs on a background thread, never blocks or delays a scan, and fails
silently if the network is unavailable. It exists so we can count active
installs and retention.
The six fields, and only these
The heartbeat is content-free by design. The complete and only fields it sends are six usage keys:
| Field | What it is |
|---|---|
| product | Which Vulkro binary sent it. |
| install_id | A random id minted once and stored in ~/.vulkro/install_id. Anonymous; not your machine fingerprint. |
| version | The scanner version. |
| os | An OS string. |
| timestamp | When the heartbeat was sent. |
| scans-since-last | One aggregate integer: scans since the last heartbeat. |
It never sends your machine_id, any file path, any project or repository
name, or any finding body. Your scan history stays on your machine;
vulkro usage reads it locally and never triggers the
heartbeat.
When you are signed in
If you have paired this machine with an account (see
Accounts and licensing), the heartbeat
additionally carries your device token (never the machine_id) so the
server can refresh your subscription lease. The lease-refresh call sends
only the device token. A refreshed lease is verified and applied silently;
if the server reports the license revoked or expired, nothing is stored
and the cached lease simply lapses at its signed expiry. When you are not
signed in, the body is exactly the six anonymous fields above.
Turning it off
| Variable | Effect |
|---|---|
VULKRO_NO_HEARTBEAT=1 | Disable the heartbeat (any non-empty value) while leaving the rest of online licensing untouched. |
VULKRO_OFFLINE=1 | The air-gap switch. Disables the heartbeat along with every other outbound network call, guaranteeing zero egress. |
VULKRO_HEARTBEAT_URL | Override the heartbeat endpoint (defaults to https://api.vulkro.com/v1/heartbeat). Useful for self-hosting or testing. |
Separately, VULKRO_NO_UPDATE_CHECK=1 disables the background version
check, and VULKRO_OFFLINE=1 disables every outbound call at once.
Related
vulkro usage- your local scan-history report (no network).- Accounts and licensing - the lease refresh.
- Offline mode - running with zero egress.
- Network reference - every endpoint Vulkro can call.