Benchmark and method
Tested on code it has never seen.
We plant vulnerabilities in test apps the engine team never reads, and mix in safe code that should stay quiet. Then we publish what Vulkro found, what it missed and what it flagged by mistake.
Planted vulnerabilities
216 of 229 found · 94%
Found Missed: 13, kept in the score
Safe code that should stay quiet
30 of 152 flagged · 20%
Flagged by mistake Left alone
- Real Criticals also rated Critical
- 32 of 90 · 36%
- Routes found with the right path
- 380 of 390 · 97%
- Critical findings on the wrong code
- 14
01The method
Kept away from the people improving it.
A tool tuned against a test it can see scores higher than it should. These apps stay unread, so the score shows how Vulkro does on code it has not met.
- 01Blind test apps9 applications nobody improving the engine ever reads. The scorer reports totals only, so no fix can be aimed at one planted bug.
- 02Planted vulnerabilities229 weak spots planted on purpose, 90 of them expected to be Critical. Each one Vulkro misses stays in the score.
- 03Safe code that should stay quiet152 lookalikes that are safe on purpose. A scanner that flags everything gets caught here.
Scanned offline and deterministically from a pinned binary: the same binary on the same apps gives the same counts. A finding counts for the nearest planted entry in the same file within eight lines. Found means a finding at Low or above; flagged safe code means a finding at Medium or above. Every scoring rule
02Every application
Each app on its own, weak ones included.
Two JavaScript and TypeScript apps and one Java app. A figure from one or two apps is a direction, not a settled rate.
The full tablevulkro 0.41.0 · measured 2026-11-02 · 9 blind applications in JavaScript, TypeScript, Python, Go and Java · re-run for every minor release · all-confidence view
03The limits
What this number is not.
The test that decides anything is your own code. Publishing a blind app would end its use as a blind test, so the apps stay private and the scoring rules are written down.
Method and the earlier run- Not a comparisonNo other scanner was run. This measures Vulkro against planted vulnerabilities and safe code, and says nothing about any other tool.
- Not real-world precisionTest apps hold more issues than production code. How often a finding on real code is a real issue is a separate, harder measure, and it is not what this page reports.
- Every confidence levelA finding counts at any confidence. The default view hides low-confidence findings, so on its own it shows fewer.
scored with --all-confidence