Free forever, or pay per term. No auto-renewal.

The term model

A term you buy, not a subscription that bills you.

Competitors auto-bill until you find the cancel button. Vulkro Pro is a per-term license with no auto-renewal: you pay once, the term runs out, and renewal is a decision you make with full information.

Why we built it this wayRefund policy: issued licenses cannot be revoked, so the trial comes first

Need it free

If the price is the only thing stopping you, write to us.

A student learning to ship safely. An unfunded open-source maintainer. A nonprofit, a school, a security teacher, a team in a place where $349 is a month's rent. If Vulkro would make your project safer and the license is the blocker, tell us what you are building. We started this to help make the internet a secure place again, and that matters more to us than losing you on price.

Contact usOpen-source maintainer? Start with the Free tier for OSS

Questions

Pricing questions, answered.

What's actually in the 14-day trial?

Full Pro. Every detector, every output format, every language. No trial-only watermark, no truncated reports, no "preview" warnings on findings. The CLI tells you on day 12 that the trial is ending. On day 15 it drops to the Free tier and keeps scanning; Pro features prompt for purchase but nothing hard-blocks. Each edition (Core and Salesforce) has its own trial.

What happens when my Pro license expires?

Vulkro keeps working at the Free tier. Pro-only features prompt you to renew, but everything in Free (the core security scan, vulnerable-dependency check, secrets, broken-auth, injection, fast incident response, the MCP server and editor extension audits, CI integration) continues without interruption. The vulnerability database updates on the same schedule as Pro: we never punish you for not paying with a stale advisory feed. What pauses until you renew is the Pro depth: the advanced detector packs (and new packs as they ship), compliance evidence, the portfolio view, and the heavy output formats. No auto-renewal, no surprise charges. Buy a fresh one-time Pro license whenever you are ready.

Is Vulkro for Salesforce the same license as Core Vulkro?

No. Core Vulkro and Vulkro for Salesforce are two separate editions of one scanner. A Core Pro license does not unlock the Salesforce edition, and a Salesforce Pro license does not unlock the core engine. Each has its own 14-day trial and its own machine-bound key. The machine ID is the same on both (it comes from your hardware), so if you have already cached it on one edition, the other picks it up automatically.

How do team licenses work?

From v0.16.0, a team license is one purchase with signed seat extensions: each developer's machine gets a seat on the same license, and a team policy file committed to your repo keeps every seat running the same gates and suppressions. There is no license server to host and no per-seat SaaS dashboard. Team licenses are sized by conversation: email us with your team size and we will quote it.

What does “one machine, single developer” mean?

Every Vulkro license is bound to one machine ID generated from your hardware. Run vulkro machine-id (or vulkro-sf machine-id for the Salesforce edition) to see yours. Need it on more than one machine, including CI? That is what the Team license is for; email [email protected].

Does Vulkro ever upload my source code?

Never. Vulkro runs entirely on your own machine. No cloud upload, no telemetry, no AI service in the loop. For Salesforce, source and org metadata stay on your laptop too; the connection to your live org uses your own Salesforce login, so the access token stays with Salesforce, not with us. See the privacy policy for the full statement, or read the manifesto for the reasoning.

Is Vulkro open source?

No. The detection code is closed source: that is the product. What we do publish is the benchmark itself: the test code, the labelled examples, and the scoring rules. You can run the benchmark on your laptop and compare our catch rate and false-positive rate against the alternatives on the same examples. We compete on reproducible results, not on source openness. (The free Vulkro Labs tools are a separate, open-source project.)

What's the line between Free and Pro?

Free covers what a single developer on one project needs to ship safely: the OWASP API top 10, vulnerable-dependency check, secret detection, auth bugs, injection, fast incident response, the MCP server and editor extension audits, and CI-friendly output for GitHub Code Scanning. Free supports Python, JavaScript, TypeScript, and Go. Pro adds what teams and regulated industries pay for: audit-ready compliance evidence (SOC 2, HIPAA, PCI, ISO 27001, and more), a portfolio view across many projects, the deeper detection packs, the heavy report formats (SBOM, executive PDF and HTML), and live API probing. Both tiers get the same vulnerability database updates on the same schedule. The full split is in the table above.

What is the AppExchange readiness report?

A Salesforce Pro feature: a single HTML report grouped by the same checklist your AppExchange reviewer uses. Section by section, what cleared and what still needs work. Email it to the reviewer or hand it to a client. No login required to read it.

Do you offer refunds?

No. Once a license file is issued it cannot be revoked, so refunds are not offered as a matter of policy. That is exactly why the 14-day full-Pro trial comes before any purchase. If you're unhappy, reach out and we'll do what we can. See the refund policy for the full text.

Buying for a consultancy with many client orgs?

For Salesforce, multi-org and per-engagement options (AppExchange Security Review prep and consultancy audits across many client orgs) are available under Enterprise: email us and we will size it to your practice.