Vulkro for open-source maintainers.

If you maintain an open-source project, you already know the shape of the problem: the code is public, the time is not, and the commercial scanners either price by contributor count, keep their free tiers shallow on purpose, or lock you to one CI provider. Vulkro's answer is direct: maintainer teams of active open-source projects are issued full licenses at no charge, on request. The honest trade is that Vulkro itself is closed source and requires an account; what is public is the benchmark harness, the methodology, and the ground-truth corpus, so you can verify the scanner before you ask.

How it works: the scanner requires an account, and a 14-day trial of the full product starts on your first login. After that, active maintainer teams of meaningful OSS projects get a license at no charge, on request (see Maintainer licenses below). No contributor-count cap, no CI lock-in, unlimited repos.

What you get​

The same license also carries the deep detector packs (and new packs as they ship), compliance evidence, portfolio, and the heavy output formats (CycloneDX, SPDX, CBOM, PDF, RoPA). There is one product, not a tier ladder: the trial and the issued license both cover everything above.

GitHub Actions in 8 lines​

name: vulkro
on: [pull_request, push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: curl -fsSL https://dist.vulkro.com/install.sh | bash
      - run: vulkro scan --format sarif --output vulkro.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: vulkro.sarif

That posts findings to the GitHub Code Scanning tab, the same surface that CodeQL writes to. Vulkro and CodeQL coexist on different rule sets and either both pass or you triage the delta. The runner needs your Vulkro account connected, same as any machine that scans; the install guide covers connecting the CLI, including the license-file route that suits CI.

Baseline + ratchet for legacy projects​

A 10-year-old repo will not pass a fresh SAST scan on day one. Vulkro's baseline workflow is built for the retrofit case:

vulkro scan --baseline .vulkro-baseline.json  # writes current state
# commit the baseline
vulkro scan --ratchet                          # only NEW findings fail

After that, contributors only see findings their PR introduces. Existing debt becomes a separate "burn down the baseline" project, on whatever cadence you have time for.

Inline suppressions when you need them​

# vulkro:disable[hardcoded-secret] until=2026-08-01 reason="test fixture"
TEST_API_KEY = "sk-test-1234567890"

The until= date is a soft deadline: once it passes, Vulkro keeps honouring the suppression but emits a low-severity suppression-expired finding so you remember to revisit. Same mechanism works for any rule id.

Honest comparison to the alternatives​

The depth gap with the free tiers is measurable: on our published corpus, Semgrep CE finds 17 of the 83 catalogued bugs in the languages both tools support, where Vulkro finds 47.

CodeQL is strong and free for public repos, but locked to one CI provider.

Every bug in the corpus is pinned to a public CVE or GHSA advisory in a real project, and a finding counts only if it lands within five lines of the catalogued bug. Findings in files we did not catalogue are neither rewarded nor penalised.

The corpus is versioned and grows: we grew our own ground truth to 90 catalogued bugs in July 2026 and published the recall drop that came with it. See the methodology for the scoring rules and the complete results.

Maintainer licenses​

All Vulkro licenses are issued directly by our team, and OSS maintainer teams are issued theirs at no charge. Email [email protected] with a link to the repo. Active maintainer teams of meaningful OSS projects get licenses for free.

Install · Benchmark · CLI reference