Vulkro Core · application code
Find the weak spots an attacker could actually reach.
Vulkro Core reads your app on your own machine and shows who could get in and how. Your AI agent or your team makes the fix, and Vulkro checks it again.
14-day trial · every language and every check · runs on your machine
Anyone can run their own SQL through the order search
- Entry pointsrc/routes/orders.ts:4
router.get('/api/orders', async (req, res) => {Express route · no sign-in needed - Callsrc/routes/orders.ts:5
const rows = await searchOrders(req.query.q)the search term passed straight on - Sinksrc/services/orders.ts:4
pool.query("SELECT * FROM orders WHERE customer_name LIKE '%" + term + "%'")SQL built from the request, no binding
- Who can reach it
- Anyone, no sign-in
- What is at stake
- Every customer's data
- Guards on the path
- None. The value is never bound
- Disposition
- Proven: traced from the request to the query
- Fix
- Bind the value:
pool.query('... LIKE $1', [`%${term}%`])
A real finding from a small test app: where the request comes in, where it goes, and the fix.
01What comes first
Ranked by who can reach it.
The same six findings, ranked twice. A rule rates them all High. Vulkro Core puts first what anyone online could use, and stops showing code that nothing reaches.
How this differs from a findings listA rule's ranking
Six findings, all rated the same.
- Shell command built from a job nameadmin/jobs.tsHigh
- File path built from an upload namelegacy/upload.tsHigh
- SQL query built from the search boxroutes/orders.tsHigh
- SQL built from input in a test fixturetest/fixtures.tsHigh
- Invoice looked up by id, no owner checkroutes/invoices.tsHigh
- Outbound request to a URL from the bodyroutes/webhooks.tsHigh
Vulkro's ranking
Ranked by who can reach it. Code nothing reaches is not shown.
- SQL query built from the search boxroutes/orders.tsAnyone, no sign-inProvenCritical
- Invoice looked up by id, no owner checkroutes/invoices.tsAny signed-in userProvenHigh
- Outbound request to a URL from the bodyroutes/webhooks.tsAny signed-in userHigh
- Shell command built from a job nameadmin/jobs.tsAdministrators onlyMedium
- SQL built from input in a test fixturetest/fixtures.tsTest code, never shippedLow
- File path built from an upload namelegacy/upload.tsNo route reaches itNot shown
02How it works
Find it, prove it, check the fix.
Every finding comes with the way in, how sure Vulkro is, and what to change. Your agent or your team fixes it, and Vulkro checks it again.
Every feature- 01FindEvery way inVulkro Core maps every route into your app, who can use it, and where what they send ends up.
- 02ProveHow sure it isEach finding shows the path it traced, or says plainly that it could not trace one. It never calls that safe.
- 03FixYour agent fixes, Vulkro checksIt says what to change and where. Your AI agent or a developer makes the change, and Vulkro scans again to confirm it is fixed.
Languages, all in every plan
- Follows data across filesJavaScriptTypeScriptPythonGoJava
- Within one functionPHPCC++
Every scan also maps your database. It reads the tables and columns from your ORM models and migrations (Prisma, Drizzle, Django, SQLAlchemy, Rails, JPA, GORM, EF Core, Laravel and more) and marks the sensitive columns. It then flags a password stored in plain text, a secret written raw, a login name that is not unique, and a sensitive table with no tenant column. Rails and EF Core are read as schema and migration sources only, not as Ruby language support. C# code gets config and syntax rules, without data flow.
03The product
Runs on your machine. Your code stays there.
The same scan in your browser, your terminal, your pipeline, your editor and your AI coding agent, so every place gives the same answer.
VulkroInstall, scan, open
# install $ curl -fsSL https://dist.vulkro.com/install.sh | bash # scan, then open the local console $ vulkro scan . $ vulkro serve
- Your pipelineFails a build on the problems that matter, with a report your code host can show.GitHub ActionsGitLabJenkinsBitbucketCircleCISet up CI
- VS Code extensionThe problem on the line that causes it, while you write it.VS CodeCursorWindsurfThe extension
- AI coding agentsYour agent asks Vulkro for the findings instead of hunting through the code: 66% fewer AI tokens on a security review, finding as many real issues in total (238 of 280). In a new codebase, Vulkro's code search gets it oriented with 55 to 69% less code read.Claude CodeCursorCodexWindsurfSecurity review against an AI agent reading the code itself. Measured with vulkro 0.32.0 on 2026-10-07, on Vulkro's own test apps, which were used to develop Vulkro, so the result is flattered.For agents
04Measured, misses included
Tested on apps it had never seen.
9 test apps in JavaScript, TypeScript, Python, Go and Java, kept unread by the people who build the engine. Each has vulnerabilities planted in it and safe code that should stay quiet.
How we measure- Planted vulnerabilities found216/22994% · 13 missed
- Ways in mapped380/39097% · right route, right method
- Critical issues rated Critical32/9036% · 58 rated lower
- Safe code flaggedlower is better30/15220% · known-safe code with a finding at Medium or above
Nine blind holdout applications, kept unread by the engine team, with planted vulnerabilities and known-safe negative controls, scanned offline and deterministically. Critical findings on safe code or on nothing planted: 14, shown rather than left out. Measured with vulkro 0.41.0 on 2026-11-02.
05For teams
Connect your repositories to Vulkro Cloud. For the whole team.
The same engine, hosted for your team. Each repository is scanned in an isolated container, in a workspace of your own, with one list of issues for everyone. Every member also gets Pro on their own machine. It starts with a 14-day trial.
- Repositories
- GitHub, GitLab, Bitbucket or any https git host, connected with an access token. Tracked branches scanned on a schedule.
- Release gates
- By default: no new Critical, no new High and no new secret. Release gates and scan on push come with every Vulkro Cloud plan.
- Pull requests
- A status, one summary comment and comments on the lines that cause a problem, on every Vulkro Cloud plan.
- Your data model
- Tables, columns and how they relate, with the sensitive columns marked.