Skip to main content
Coming soon: Vulkro Red, a red team on the same engine as the reviews

The review, and the path it proves

.

Vulkro reads your whole application on your own machine: Python, JavaScript, TypeScript, Go, Java, C, C++ and PHP, plus the containers, infrastructure files and package lists next to the code. It follows what a user can type to where it does damage, and reports a vulnerability only with the path that proves it. Nothing is uploaded.

Try it on your own codeSee what it caught and missed

Ten minutes to the first result. 14-day trial, no card.

// the path, as the console shows it //How attack paths are built ›
GET /orders/lookup◆ SQL injection · VULK-1042
  1. checkout.py:214reads order_id from the request
  2. services/orders.py:88passes it on unchangedunchecked
  3. db/query_builder.py:41pastes it into the SQL textunchecked
  4. db/session.py:57runs the assembled statementruns it

2 of 4 hops check nothing. The path is the evidence.

How it works_

Three steps, then the table that states the depth for every language, including the cells that are blank. Every check also reports which files it could not read, so a partial check is never mistaken for a clean one.

  1. Maps every way in
  2. Follows the data
  3. Proves it, then ranks it
// analysis depth per language //
Analysis depth for each supported language, by capability. Each cell is full, partial or none.
LanguageRoute mappingentry pointsTaint, same filesource to sinkTaint, across filesvia call graphFramework awarenessrouters, ORMsDedicated detectorslanguage rules
PythonDjango, Flask, FastAPIFullFullFullFullFull
JavaScriptExpress, Koa, Next.jsFullFullFullFullFull
TypeScriptExpress, NestJS, Next.jsFullFullFullFullFull
Gonet/http, Gin, Echo, chiFullFullFullFullFull
Javasame-file data flow onlyFullFullNoneFullFull
PHPsingle-function taint; Laravel, Symfony sourcesNonePartialNonePartialFull
Csingle-function taintNonePartialNoneNoneFull
C++the C rules run here tooNonePartialNoneNoneFull
Terraform, Dockerfileconfiguration, not data flowNoneNoneNoneFullFull
  • Fullruns on every scan of that language
  • Partiallimited to the cases named in the row
  • Nonenot analysed at this depth today
**Across files follows a value from the file it arrives in into the risky call in another, up to four calls deep. Java is same-file. C, C++ and PHP are single-function.**

Maps every way in

Every route the frameworks declare, the handler behind it, and whether reaching it needs a session. Routes built from variables are resolved, not skipped.

Follows the data

Inside a function, between functions in a file, and across files by following which functions call which. Any check on the way is noted; a missing one is the vulnerability.

Proves it, then ranks it

A problem is reported as proven only when the path is complete. Everything else is shown as unproven or not checked, so what you see first is what you fix first.

Depth by language, in fullHow attack paths are built

What it finds_

180+ security checks, all on one pass, all on your machine. The families that matter most:

  • Injection

    Database queries, shell commands and templates built from something a user typed, including the ones a data layer or an ORM assembles.

  • Broken access control

    Records, fields and pages anyone can reach by changing a number in the address, missing permission checks, and forged requests.

  • Every endpoint you ship

    An inventory of every route, the handler behind it, and whether reaching it needs a session, including the ones you forgot.

  • Leaked secrets

    124 kinds of key and password, recognised by the shape each provider issues, in the code and in git history.

  • Vulnerable packages

    Known bugs in the packages you use, matched on your machine and ranked by whether your code can reach them. The default bundle is npm and PyPI.

  • Infrastructure and containers

    Terraform, Kubernetes and compose files checked against a built-in AWS, Azure and GCP catalogue; Dockerfiles; and built images read from disk.

  • C, C++ and PHP

    Dangerous C library calls, format strings and use-after-free shapes; PHP injection, file inclusion, unsafe unserialize and login bypass.

  • AI agent and MCP risks

    Agent tools that execute code, unsafe model and data loading, and misconfigured MCP servers, in the code and in the configuration.

  • Evidence for auditors

    What you ship (SBOM), which known bugs affect it (VEX), and control-by-control evidence for SOC 2, ISO 27001, HIPAA, PCI DSS and NIST 800-53.

next — where it runs — every check on your own machine

Where it runs_

Every check runs on your own computer, and the air-gap switch closes the one line that ever leaves it.

What stays

The code it reads, the map it builds of your application, and every problem it finds. All of it on your disk.

What leaves

One daily licence check carrying a handful of usage counts. Never your code, never a file name, never a finding.

The air-gap switch

Turn it on and nothing leaves at all, not even the update check. Vulnerability data arrives as a checksummed bundle, and the licence is a file.

Running it with no internetHow the vulnerability bundle is built
// what leaves, and what never does //
trust boundaryone switch closes it
your machineSource coderead from diskCall graph + taintbuilt in memoryFindings~/.vulkro/scans.dbAccount layersigned lease on diskLocal model: Ollama on 127.0.0.1 (loopback)one crossingVulkroentitlement check

Before a release_

Three controls for the first-run number, none of them a quiet way to ignore the report.

Only new problems block

Compare against the branch you merge into, so ten years of old debt never blocks a pull request. A committed snapshot does the same for a release.

Set aside, in the code, with an expiry

A one-line note above the code names the rule and a date. It is reviewed in the diff and stops working on the day you set.

Turn the volume down, not off

Three confidence levels: stop a release on the highest, work the middle as a backlog, sweep the lowest. Nothing is deleted, only ranked.

Running it before a releaseSetting a problem aside
// the pull-request comment //
vulkrobot · commented just now

HIGHBroken authorization on invoice download

routes/invoice.ts:47VULK-1042CWE-639

Nothing scopes the lookup to the caller's organisation, and requireAuth only proves they are signed in. Any signed-in user can read another org's invoice by changing the number in the URL.

Suggested change

Line beforeLine afterChangeSource
@@ -45,7 +45,11 @@ router.get('/invoices/:id/download')
4545router.get('/invoices/:id/download', requireAuth, async (req, res) => {
46Removed line. const invoice = await db.invoice.findUnique({
47Removed line. where: {id: req.params.id},
46Added line. const invoice = await db.invoice.findFirst({
47Added line. where: {id: req.params.id, orgId: req.org.id},
4848 });
4949 
50Added line. if (!invoice) {
51Added line. return res.status(404).send('not found');
52Added line. }
53Added line.  
5054 return res.download(invoice.path);
5155});
Re-scanned. Finding no longer reported, file still parses.verified before posting

vulkro scan · exit 1 · 1 high, 0 criticalRan on your runner. The code never left it.

Evidence_

26 report formats from a single run, in the shapes your pipeline and your auditor already read.

What you ship.

A package inventory in the CycloneDX and SPDX formats, and a separate inventory of the cryptography.

Which known bugs affect it.

An exploitability statement (OpenVEX and CycloneDX-VEX) for every package advisory, citing the path behind the verdict.

Control by control.

Evidence packs for SOC 2, ISO 27001, HIPAA, PCI DSS 4.0 and NIST 800-53, one file per control, plus a GDPR Article 30 template.

SBOM and VEXThe compliance packsEvery report format
// a compliance pack, on disk //
vulkro cra-bundle . --framework soc2-fullexit 1, findings present
  • cra-readiness.zip/built on this machine
    • index.htmlreadiness one-pager
    • compliance/soc2-full, 61 controls
      • manifest.jsonframework, scan id, control summary
      • summary.mdevery control with its status
      • findings.csvfinding to control mapping, flat
      • soc2-full.htmlper-control evidence table
      • controls/one file per control
        • CC6.1.jsonPass
        • CC6.6.jsonPartial, 2 findings
        • CC7.2.jsonFail, 1 finding
        • ...58 more control files
    • sbom/
      • cyclonedx.jsonCycloneDX 1.6
      • spdx.jsonSPDX 2.3
    • vex/
      • openvex.jsonOpenVEX 0.2.0, per CVE

$ vulkro compliance-pack . --framework soc2-full --output ./compliance/

Every file is written locally, and each control cites the findings it was built from.

// what leaves, and what never does //
trust boundaryone switch closes it
your machineSource coderead from diskCall graph + taintbuilt in memoryFindings~/.vulkro/scans.dbAccount layersigned lease on diskLocal model: Ollama on 127.0.0.1 (loopback)one crossingVulkroentitlement check

Where it runs_

Install it once. The same check, with the same answer, in every place code gets written and shipped.

Editor extension

Risky lines underlined while you type, with the fix on hover.

AI assistant add-on

The assistant checks its own work, and every file it writes.

MCP server

Any assistant can ask for a check from the chat.

Local console

Every problem found, on your machine, nothing uploaded.

Build pipeline

A comment on the pull request with a patch, and a failed build.

For the whole team_

The five surfaces above are for the person writing the code. The organisation dashboard is for everyone else: which repositories are covered and how fresh, the proven issues that are open, a P0 queue with a clock, and the trend. Any member with a token can publish to it; only admins can view. It needs online mode, and it is part of the online seat.

What crosses the wire

A publish uploads a map of the application: file and module names, API routes, and the file and line behind each finding, plus your dependency inventory. Never your source, your snippets or your secrets. Run "vulkro publish --preview" to see the exact payload first.

Hosted, or your own server

Use our instance or self-host the same server from a Docker image or Helm chart. Publishing is refused while offline mode is on, so a fully air-gapped organisation is not supported.

next — where it falls short — stated here, not found on day two

Stated here rather than discovered on day two.

  1. A value that leaves a method is not followed into the function it calls, so a vulnerability that crosses files in Java is missed.
  2. Input reaching a dangerous call inside the same function is proven; a value that leaves the function is not followed, and there is no route map or access model for these languages yet.
  3. It catches the dangerous calls and patterns behind most published C vulnerabilities, not out-of-bounds proofs or value ranges.
  4. Their package lists, containers and secrets are still read.
  5. It comes from how the code looks, and it applies to npm and PyPI only.
  6. Nothing is pulled from a registry, and jars inside jars are not opened.
  7. It flatters every tool, ours included. The number to trust is a check of your own code, which is why the trial is the pitch.

Try it on your own code.

It runs on your machine, nothing is uploaded, and you will know in ten minutes. Your first sign-in starts a 14-day trial of the full product, no card.

Start the 14-day trial

Licensing

Licences are per seat with everything included; subscribe from your account or ask our team for a quote, and air-gapped teams get a licence file that never calls home.

Talk to us →

Vulkro is a product of Reveriext.

reveriext.com

Visit Reveriext