What the tool found, run in the open
.
A scanner that only publishes its hits is telling you half a result. Below is the whole one: 33 of 83 catalogued bugs found, 50 missed, 20 false alarms. The misses stay in the corpus rather than being removed from it.
The result_
Scored at the confidence setting we recommend for stopping a release, with a match window of file plus line within five lines. Precision 0.62, recall 0.40, F1 0.49.
33 of 83
Found · proven
Real, documented vulnerabilities located and proved with a complete path.
- Measured on vulkro 0.28.0
- 2026-09-18
- Tier 1 corpus, min-confidence high, match window file + line plus or minus 5
- 33 of 83 proven
- 50 missed, published
- 20 false alarms
Every catalogued bug cites the project’s own vulnerability documentation, an in-source vulnerability marker, or a published CVE or GHSA pinned to the scanned commit, and was confirmed by reading the sink at that commit. Bugs the scanner misses stay in the corpus as false negatives.
- What this number is not
- A fixed test set flatters every tool, ours included, because the tool can be tuned against it and the corpus stops being a surprise. The only benchmark that decides anything is your own code, which is what the 14-day trial is for.
The comparison_
The other scanners are unnamed. Naming a competitor on a rendered page is against our own rule, and the cards carry the whole argument anyway: the one that finds more also flags over three times as many false alarms and takes about eleven times as long.
Vulkro
- Found
- 33
- Missed
- 50
- False alarms
- 20
- Precision
- 0.62
- Recall
- 0.40
- F1
- 0.49
- Time
- 32.0s
Scanner A
- Found
- 43
- Missed
- 40
- False alarms
- 72
- Precision
- 0.37
- Recall
- 0.52
- F1
- 0.43
- Time
- 354.4s
Scanner B
- Found
- 17
- Missed
- 66
- False alarms
- 15
- Precision
- 0.53
- Recall
- 0.20
- F1
- 0.30
- Time
- 36.6s
Scanner C
- Found
- 17
- Missed
- 66
- False alarms
- 15
- Precision
- 0.53
- Recall
- 0.20
- F1
- 0.30
- Time
- 33.7s
- Measured
- vulkro 0.28.0 · measured 2026-09-18 · Tier 1 corpus, min-confidence high, match window file + line plus or minus 5
- Not in this table
- 8 other tools have no head-to-head run against this corpus, so there is no figure to cite for them. Absence here is not an oversight.
A second, independent suite_
A different suite, a different binary, a different method, so it never shares a table with the roll-up above. 2,740 cases, scored with AI off. Youden 38.35 — the suite’s own metric, true-positive rate minus false-positive rate — from a true-positive rate of 62.6% against a false-positive rate of 24.3%, averaged across the eleven scored categories.
2 of 6
Rank · untuned run
Rows are ordered by Youden index, the suite’s own metric. The five comparison rows are the scorecards OWASP publishes with BenchmarkJava; the Vulkro row was measured against the version named below. Both rates are averaged across the eleven scored categories, which is the basis the published scorecards record.
Three things wrong with reading this as a win
It is not like-for-like
The five comparison scorecards were produced against tool versions from around 2016. The Vulkro row was measured in 2026. That is a ten-year gap, and it is not a contest those tools were entered into.
The lead is thin
Second place sits 0.75 of a point behind first. That is inside the noise of a single category, and it is not a margin that should be expected to survive the next measurement.
We are on the same spectrum
The top row reaches its score by flagging almost everything — a 96.84% true-positive rate against a 57.74% false-positive rate. Ours is 24.3%, which is better on this suite but is the same trade, not an escape from it.
Checking it yourself_
Every catalogued bug in the Tier 1 corpus cites the project’s own vulnerability documentation, an in-source vulnerability marker, or a published CVE or GHSA pinned to the scanned commit, and was confirmed by reading the sink at that commit. The scoring rules and the match window are written down at the link below. The corpus repository itself is private, so we do not describe it as a public corpus. The check that decides anything is the scanner run on your own code, at the setting the benchmark was scored at:
# the same setting the benchmark was scored at
$ vulkro scan . --min-confidence high
# stop a release on what you decide matters
$ vulkro scan . --fail-on critical,high
# the result, written for a reviewer
$ vulkro scan . --format sarif > vulkro.sarifRun it on your own code.
Create an account and your first CLI sign-in starts a 14-day trial of the full product. Every scan runs on your machine; your code never leaves it.
Reproduce the numbers
The harness, the scoring rules and the match window are documented so you can run the same shape of test on code you choose.