Vulkro for Salesforce vs Gearset Code Reviews

Gearset Code Reviews is the static analysis capability inside the Gearset DevOps platform. It began as Clayton, an independent Salesforce code review product, and joined Gearset by acquisition in 2024. Today it runs deterministic checks over Salesforce code as part of the suite that also handles deployments, pipelines, and backups. The Clayton lineage shows: the review feedback loop is polished, and for teams already releasing through Gearset the findings arrive inside the workflow they use every day.

Salesforce coverage on our side is the Vulkro for Salesforce edition (the vulkro-sf binary), not the general vulkro scanner. This is not a feature race between two similar tools. It is a category comparison: the code review tab of a DevOps suite against a specialist security scanner. Both are legitimate shapes. This page lays out what each shape buys you.

At a glance​

The category distinction​

Gearset Code Reviews is one capability inside a suite. Gearset's center of gravity is Salesforce DevOps: deployments, CI/CD pipelines, rollbacks, org comparison and sync, backups. Code Reviews brings static analysis into that release workflow, which is exactly where a DevOps team wants review findings to appear. It is a real strength, and it also defines the product's frame: analysis is one tab among the suite's many jobs.

Vulkro for Salesforce is the whole product. Every release of vulkro-sf is judged on one thing: the quality of its security findings. That focus is what pays for inter-procedural CRUD/FLS taint across class boundaries, Flow XML deep analysis, Connected App OAuth posture, Agentforce detectors, the live-org audit, and the AppExchange Security Review readiness report. We publish the detector methodology so each of those claims can be checked rather than taken on faith.

The distinction matters in three buyer scenarios:

1. ISVs prepping for AppExchange Security Review​

The submission is competitive: your managed package is, by definition, an unreleased product. Vulkro for Salesforce keeps the prep entirely on the developer's machine, and vulkro-sf appexchange-report produces an HTML readiness report grouped by the reviewer checklist. A suite built for release management does not target this submission.

2. Consultancies with client confidentiality clauses​

Most modern client NDAs ask whether your audit tools are third-party data processors. A cloud platform that connects to the client's version control and orgs is one; a binary on the consultant's laptop is not. With Vulkro the answer to the procurement question is simple: nothing leaves the machine.

3. Teams already running Gearset​

Keep Gearset. If it runs your deployments, pipelines, and backups, nothing on this page argues for ripping it out; a scanner does not deploy anything. The pattern that works is side by side: Gearset keeps the release workflow, and vulkro-sf adds the security depth, the posture audit, and the readiness report on top of the same repository.

Coverage depth​

The depth claims we make are specific and published:

• CRUD/FLS posture per method. A private helper that checks isUpdateable() before a public @AuraEnabled method performs DML is enforcement, not a gap. Vulkro builds the intra-class call graph, follows the delegation, and extends across classes via the project-wide method table.
• JSON.deserialize mass-assignment. The deserialize call only matters if the payload is request-derived; Vulkro tracks the source instead of flagging the pattern wholesale.
• Flow XML deep analysis. runInMode, system-context DML, and hardcoded IDs inside Flow definitions, not just Apex.
• Live-org posture. Sharing settings, session settings, permission over-privilege, and Connected App OAuth scope audit against the org itself, through your own sf CLI login.

Every detector, with its checklist mapping, is listed in the methodology. Check the claims against your own codebase during the trial.

Re-scan-verified Apex fixes​

vulkro-sf ships deterministic fix templates, and Vulkro AI (local) can draft a patch for findings without a template. The model runs locally through Ollama: no cloud call, no API key, and it is advisory only; it never changes a deterministic scan verdict, and the benchmark stays AI-free.

The verification claim is narrow on purpose. A fix is verified in one sense only: a fresh deterministic re-scan no longer reports the finding and the file still parses. It is not a claim that your build compiles or your tests pass; your CI keeps that job. Refused drafts change nothing.

$ vulkro-sf fix --ai

[CRITICAL] SOQL injection in LeadSearchCtl.cls
  draft: bind the user input
  parse check: ok
  re-scan: finding no longer reported
  verified, fix applied

$ vulkro-sf fix --ai

[HIGH] CRUD check missing in QuoteCtl.cls
  draft: guard the DML with isUpdateable()
  parse check: ok
  re-scan: finding still present
  refused, nothing changed

Licensing​

vulkro-sf requires a verified account, and a 14-day trial of the full product starts on your first vulkro-sf login. After the trial, licenses are issued directly by our team. Air-gapped orgs use a signed, machine-bound .lic file instead of signing in. Email [email protected] to start a conversation. Gearset Code Reviews is sold as part of the Gearset platform; this page argues categories, not price.

What Gearset does that Vulkro does not​

Honest comparison. The Gearset suite has things a scanner does not:

• Deployments and rollbacks. Comparing orgs, promoting metadata, and rolling a release back is the suite's core job. Vulkro deploys nothing.
• CI/CD pipelines and org sync. Pipeline orchestration across environments, sandbox seeding, and backups live on Gearset's side. Vulkro is pipeline-agnostic; you wire it into whichever CI you already use.
• Review inside the release workflow. Findings surfaced where the team already manages releases, with the polished feedback loop the Clayton team built.

Pick Gearset if the release workflow is the problem you are solving. Pick Vulkro for Salesforce if security depth, data-handling posture, the AppExchange submission, or the live-org audit matters more. Many teams will reasonably run both.

Try it side by side​

There is no migration. Vulkro is a CLI you install on a laptop; existing Gearset pipelines keep running while you trial vulkro-sf on a single repository or engagement. Compare findings on the same codebase and decide from the output.

# Install the Salesforce edition:
curl -fsSL https://dist.vulkro.com/install-sf.sh | sh

# Scan your DX source offline:
vulkro-sf scan force-app

# Build the AppExchange readiness report:
vulkro-sf appexchange-report -o readiness.html

Talk to us​

Email [email protected]

See also: Vulkro for Salesforce vs CodeScan, Vulkro for Salesforce vs DigitSec, Vulkro for Salesforce, Salesforce methodology, Benchmark.