One subscription, per seat
.
No tiers to compare and no feature held back for a bigger plan. Every licence includes every check, every language, every output format and the air-gapped mode. Your first sign-in starts a 14-day trial of the full product, no card.
Subscribe per seat from your account and cancel any time, or write to license@vulkro.com for a team quote or an air-gapped licence.
What you licence_
The same engine pointed at two subjects. Licence either, or both. Vulkro Labs is free and needs no account at all.
Licensed
Reviews your codebase before a release.
- Python, JavaScript, TypeScript, Go, Java, C, C++ and PHP
- Attack paths, access control, injection, leaked secrets
- Dependencies, containers and infrastructure files
- SBOM, VEX and control-by-control audit evidence
- Editor extensions, CLI, CI/CD and the desktop console
LicensedReviews what your team built on Salesforce, plus the org.
- Apex, Flow, LWC and the org settings a reviewer reads
- Record and field access, sharing, guest access
- The AppExchange Security Review readiness checklist
- Unreleased package scanning
- Runs against your own org, on your own machine
Coming soonWorks out what an attacker would do with it: which small problems chain into a real break-in, and which are noise.
- Chains stage by stage, reading only the code on disk
What it doesannounced, not yet installable
Free, no accountChecks what an AI assistant wants to add to your project.
- Twelve keyless commands, one binary
- Hallucinated and malicious package checks
- MCP server, tool, skill and editor-extension vetting
- No account, nothing uploaded
Everything included
The list below is not a plan comparison. It is what a licence is.
Every check
All 180+ security checks, every language the engine reads, and every one of the 26 output formats. Nothing is reserved for a higher tier.
The air-gapped mode
Not an add-on. Turn it on and nothing leaves at all, not even the update check. Vulnerability data arrives as a checksummed bundle.
CI and release gating
Run it on every change and fail a build on what you decide matters. Same code, same verdict, every time.
Audit evidence
SBOM, VEX, and control-by-control evidence for SOC 2, PCI, HIPAA, GDPR and ISO 27001, generated from the scan you already ran.
The deal_
The trial
Your first sign-in starts a 14-day trial of the full product. No card, and no feature withheld during it. Ten minutes to the first result on your own code.
The unit
A licence covers a seat, with everything included. There is no per-repository, per-scan or per-finding metering.
How to buy
Two ways, your choice. Subscribe per seat from your account, self-serve, and cancel any time; or ask our team for a quote (teams, air-gapped machines, volume) at license@vulkro.com.
Air-gapped teams
A signed, machine-bound licence file that never calls home. No daily licence check, no network path out of your environment at all.
What leaves your machine
On a normal licence, one daily check carrying a handful of usage counts. Never your code, never a file name, never a finding. On an air-gapped licence, nothing.
Procurement
Security questionnaires and DPAs go to contact@vulkro.com. These are usually quick, because your code never leaves your machines and there is no data processor to review.
Getting a quote_
Write to license@vulkro.com. This is the list we would otherwise have to ask you for.
- 01Seats
- 02What to review
- 03Air-gapped or not
- 04Contracting entity
- 05Trial account
- 01How many seats you need.
- 02What you need reviewed: a codebase, a Salesforce build, or both.
- 03Whether any of the machines are air-gapped.
- 04The contracting entity and country.
- 05Your trial account details, if you have already run it.
- Your first sign-in starts a 14-day trial of the full product. No card, and no feature withheld during it. Ten minutes to the first result on your own code.
- A licence covers a seat, with everything included. There is no per-repository, per-scan or per-finding metering. Licence either, or both. Vulkro Labs is free and needs no account at all.
- A signed, machine-bound licence file that never calls home. No daily licence check, no network path out of your environment at all.
- VS Code, Cursor and Windsurf extensions, the CLI, the desktop console and the web console. One licence covers the seat, not the surface.
- Product support at support@vulkro.com, and vulnerability-data updates for the term of the licence. Invoices and payment questions go to billing@vulkro.com. Security questionnaires and DPAs go to contact@vulkro.com — usually quick, because your code never leaves your machines.
Try it on your own code.
Create an account and your first CLI sign-in starts a 14-day trial of the full product. Every scan runs on your machine; your code never leaves it.
Licensing and air-gapped deployment
Licences are per seat with everything included. Subscribe from your account and cancel any time, or ask our team for a quote. Air-gapped teams get a licence file that never calls home.