Pricing

Direct licensing, starting with a 14-day trial.

Vulkro is licensed per seat, and licensing is handled directly by our team rather than a checkout page. Sign up, and your first CLI login starts a 14-day trial of the full product, no card required. When the trial ends, write to us and we issue your team's license, including signed, machine-bound license files for air-gapped machines.

Start the 14-day trial Request a license →

Full product from day one
Licensed per seat, by our team
Air-gapped license files available

$ vulkro login

Confirm this code in your browser: KWZR-4832
Opening: https://app.vulkro.com/activate
Waiting for approval...

Paired. Logged in as [email protected].
Lease valid through 2026-08-11

First login on a new account. The 14-day trial of the full product starts on its own.

01 / How it works

Trial first, then a direct license.

Three steps, and only the last one involves talking to us. The trial is the full product, not a limited tier.

Create an account and connect the CLI

Sign up, install the scanner, and sign in from the command line. Your first device login starts a 14-day trial of the full product automatically. No card required.

Scan on your machine

Every scan runs locally; your source is never uploaded and never enters a model. The CLI refreshes its entitlement once a day, and the signed lease it holds stays valid for 14 days, so short offline stretches never interrupt your work.

License your team when the trial ends

Vulkro is licensed per seat, directly through our team. Write to us and we set you up. Air-gapped environments get a signed, machine-bound license file that works with no network access at all.

Install guide What leaves your machine (and what never does)

02 / The product

Two flagships, one licensing model.

Vulkro reviews the code your team ships; Vulkro for Salesforce reviews your org. Each is the whole product with no feature tiers: the trial and the issued license are the same scanner. License the edition your team ships on, or both.

For your codebase

Vulkro

The offline scanner for everything you ship outside Salesforce: deterministic security review of the code your team and its assistants write, with the same verdict every run and no AI in the scan.

Security checks for JavaScript and TypeScript, Python, Go, and Java, each finding named with file, line, and fix
Dependency risk across npm, PyPI, Go, Cargo, and Maven, with checksummed CVE bundle updates from the Vulkro CDN
Compliance evidence packs, SOC 2 and ISO 27001 through PCI-DSS 4.0 and HIPAA
Machine-readable output: SARIF, CycloneDX and SPDX SBOMs, OpenVEX, and executive PDF and HTML reports
Portfolio view: scan and track many projects at once
Email support, direct from the Vulkro team

Start the 14-day trial →

For your Salesforce org

Vulkro for Salesforce

The offline scanner for the platform: Apex, Lightning, Flow, and the Agentforce surface your org now runs, reviewed in the language the AppExchange Security Review uses. No AI in the scan, and it reads zero customer records.

Agentforce and AI-agent review: the ForcedLeak class, agent actions bound to without-sharing Apex, and grounding on untrusted free-text fields
Apex, Lightning (LWC and Aura), Flow, and Visualforce checks, with interprocedural Apex taint and an LWC-to-Apex bridge
AppExchange Security Review readiness: a READY or GAPS verdict, a CI presubmit gate, and a hand-off report grouped by the reviewer checklist
Well-Architected anti-pattern review across code, sharing, and org configuration
A live-org posture audit that runs through your own sf CLI login, reads zero customer records, and never holds your OAuth token
Email support, direct from the Vulkro team

Start the 14-day trial →

What the core scanner checks What Vulkro for Salesforce checks

03 / Questions

Straight answers.

Why is there no price on this page?: Licensing is sales-led: we quote per seat for your team's size and environment, including air-gapped deployments. Write to [email protected] and we respond with terms.
Do I need an account to use Vulkro?: Yes. The CLI scans against a verified account: either a signed lease from signing in, or an installed license file for air-gapped machines. Your first device login starts a 14-day trial, so you can evaluate the full product before licensing your team.
Does my code leave my machine?: No. Scanning is entirely local and your source code is never uploaded. The daily entitlement check sends only a small set of usage keys, never your code, never file names, never findings; the trust page lists exactly what those keys are. The Salesforce live-org audit reads org settings and definitions through your own sf CLI login only, reads zero customer records, and never holds your OAuth token.
What about machines with no internet access?: Air-gapped and strict-egress environments use a license file instead of the online lease. Ask us for one when we set up your license and the CLI will run without any network access.
What happens when the 14-day trial lapses?: The CLI asks you to license your seat. Nothing you produced goes away: reports, scan history, and configuration stay on your machine and are yours to keep.
Do you cover code outside Salesforce?: Yes. The core Vulkro scanner covers JavaScript and TypeScript, Python, Go, and Java, plus dependency risk across npm, PyPI, Go, Cargo, and Maven. It is licensed the same way: per seat, directly through our team, at [email protected]. See what the core scanner checks.