Skip to main content

Why Vulkro

Why teams choose Vulkro: attack paths with proof

Most security tools hand you a list. Vulkro hands you the attack path: who can get in, what that reaches, and the evidence for every hop, the same way on every run.

Get startedBenchmark and method

753 Salesforce checks · 8 application languages · detection with no model

acme-prod · Production orgLast scan 4 min ago
01 IDENTITY02 ACCESS03 CODE04 DATAGuest userCustomer portal sitePartner userPartner communityIntegration userAPI onlySales rep214 usersCommunity profileProfilePortal_AccessPermission setAPI_IntegrationPermission setSales_OpsPermission set groupInvoiceControllerApex · without sharinginvoiceListLWCRefund_RequestFlowCaseServiceApexAccountObjectBank_Account__cInvoice__c · financialContact.EmailPersonal dataCaseObject
  1. IdentityGuest userCustomer portal site
  2. AccessPortal_AccessPermission set
  3. CodeInvoiceControllerApex · without sharing
  4. DataBank_Account__cInvoice__c · financial
AP-07CriticalProven

A guest user can read Invoice__c.Bank_Account__c

Path
4 hops
Rule
sf-guest-aura-read-no-fls
Fix first
InvoiceController: with sharing

01Attack paths

Vulkro connects findings into attack paths

A guest user, a permission set and a class that runs without sharing are three Medium findings in a report. Together they show who can read your invoices.

How the path is built

  • The problem

    Lists rank each finding on its own

    The dangerous combination of three Medium findings sits on page six, and the alarming permission nobody holds sits on page one.

  • What Vulkro does

    It connects related findings

    Who can get in, what they are granted, what that runs and what it reaches, read as one system and joined into the path an attacker would walk.

  • What you get

    A short list and the best place to fix

    Severity follows who can reach the code and what is at stake. Most paths have one cheap place to break them, and that is the fix to make first.

02Salesforce depth

Vulkro reads the org and the code together

A permission set is only as dangerous as the code it unlocks, and a class is only as exposed as the users who can call it. Vulkro reads both sides and joins them.

Vulkro for Salesforce
Checks
753 in the catalogue: 147 on the live org, 606 on code and metadata (vulkro-sf checks, vulkro-sf 0.22.1).
Code
Apex, LWC, Aura, Visualforce and Flows, with every way in and the data each method reaches.
Org
Users, profiles, permission sets, MFA, sessions, sharing, connected apps, guest access and Health Check, read only.
Reachability
Findings checked against who actually holds each profile and permission set, so a grant nobody holds is not reported as a live risk.
Records
Never read. Settings and definitions only.

03Proof on every finding

Each finding is Proven, Unproven or Not checked

Every finding says how sure Vulkro is and why. The proof is part of the free product, because the evidence is what tells the signal from the noise.

  • Proven

    Every hop established

    The path from the entry point to the risky call is complete, with the file and line of each step.

  • Unproven

    One hop is missing

    Something looked wrong but a hop could not be established. It is reported as unproven, never quietly promoted.

  • Not checked

    Reported, never counted as a pass

    Code Vulkro did not examine, or an org check your login could not run, reads not checked or not evaluated. It is never counted as a pass.

vulkro · orders-apijs-taint-sql-001
CriticalProven

Anyone can run their own SQL through the order search

  1. Entry pointsrc/routes/orders.ts:4
    router.get('/api/orders', async (req, res) => {Express route · no sign-in needed
  2. Callsrc/routes/orders.ts:5
    const rows = await searchOrders(req.query.q)the search term passed straight on
  3. Sinksrc/services/orders.ts:4
    pool.query("SELECT * FROM orders WHERE customer_name LIKE '%" + term + "%'")SQL built from the request, no binding
Who can reach it
Anyone, no sign-in
What is at stake
Every customer's data
Guards on the path
None. The value is never bound
Disposition
Proven: traced from the request to the query
Fix
Bind the value: pool.query('... LIKE $1', [`%${term}%`])

04Deterministic and efficient

The same findings on every run, with no model

Detection is static analysis, not a prompt. Run it on Monday and on Friday and you get the same findings, so a change in the list means a change in the code.

Repeatable
The same code gives the same findings, every run, on every machine.
Fast
A typical repository scans in seconds on a laptop, with no server and no queue.
Detection
Zero model tokens. The scan engine calls no model at all.
With your agent
98% fewer tokens in agentic development and security review, measured against an AI agent reading the codebase itself to find the same issues (internal measurement, vulkro 0.28.0, September 2026).

05Where it runs

Runs on your machine and in your pipeline

The scanners run on your machine and in your pipeline. Your source code never has to leave your network for Vulkro to read it.

On your machine
macOS, Linux and Windows for Vulkro for Salesforce; online, offline or air-gapped.
In your pipeline
SARIF for code scanning, diff scans on pull requests and an exit-code gate.
Air-gapped
Vulnerability data arrives as a checksummed bundle, so an offline scanner does not go stale.
In the cloud, if you choose
Vulkro Cloud scans orgs read-only, each company in its own workspace with its own database, storage and keys.

06One engine

One engine in four products

The editor, the terminal, the pipeline and the cloud agree on every finding, because they run the same analysis. An issue found in production is fixed where the code is written and closed by the next scan.

  • vulkro

    Vulkro Core

    Application code: JavaScript, TypeScript, Python, Go, Java, PHP, C, C++.

  • vulkro-sf

    Vulkro for Salesforce

    Apex, LWC, Aura, Visualforce, Flows, metadata and the live org.

  • Cloud

    Vulkro Cloud for Salesforce

    Every org on a schedule, with history, Changes and Fix first. Available by invitation.

  • Editor

    VS Code extension

    The finding on the line that causes it, with the explanation and the fix.

Your Salesforce

  • acme-prodProduction
  • acme-uatSandbox
  • acme-partnerExperience Cloud

Read-only. Settings, metadata, code.

Vulkro Cloud

acme.vulkro.com

  • Posture and Fix first
  • Issues, kept across scans
  • Attack paths
  • Identity & access, exposure
  • Changes and history
VK-214Open

Editor

VS Code extension

Findings on the line, as you write Apex, LWC, Aura, Visualforce and Flow.

VS Code · Cursor · Windsurf

Terminal and CI

vulkro-sf

Scan the project, audit an org, gate the deploy, work the workspace list.

macOS · Linux · Windows

MCP and skill

AI coding agents

Assistants ask for a check, read the path, fix and verify.

Claude Code · Cursor · Codex · Copilot

Your team's tools

  • Slack
  • Microsoft Teams
  • Jira
  • PagerDuty
  • Google Chat
  • Discord
  • Email
  • Webhooks

One issue, end to end

1 / 6

Production, sandboxes and Experience Cloud orgs are scanned in parallel, read-only: settings, metadata and code, never records.

07The categories

Three ways to look for vulnerabilities, side by side.

No vendor is named. Each column describes a category of tool, and where a cell depends on the product, it says so.

the shape of the categoryno vendor named
How a findings-list scanner, a model-only review and Vulkro compare across seven capabilities.
CapabilityFindings-list scannerModel-only reviewVulkro
What you getA list of findings, each ranked on its own.A written review, in the model’s words.Findings joined into attack paths, from who gets in to the data they reach.
Evidence behind a findingThe rule that matched, with a file and line.The model’s explanation of what it read.The path, hop by hop, marked proven, unproven or not checked.
Same code, same answerYes, for a fixed rule set.Not guaranteed: model output can vary from run to run.Yes. The engine is deterministic.
Model tokens to detectNone.Grows with the amount of code the model reads.None. The scan engine calls no model.
Intent the rules do not encodeOnly what a rule describes.A strength: a model can reason about intent in prose.Rules and data flow only. An optional model drafts fixes, and the detector checks them.
Runs offline or air-gappedDepends on the product.Only with a model you host yourself.Yes. Nothing is uploaded, and vulnerability data arrives as a checksummed bundle.
Measured accuracyDepends on the product.Hard to measure when the output varies.A published method and corpus results, the misses next to the hits.

A model reading code is good at intent and weak at repeatability. A rule engine is the reverse. Vulkro decides with the deterministic engine and lets a model help only where a person reviews the result.

08Honest about limits

What it misses, published next to what it finds.

The known limits, listed before you start.

The benchmark, including the misses
It misses real bugs.
On 9 blind holdout applications it found 181 of 229 planted vulnerabilities and missed 48. It rated 32 of 90 Criticals as Critical, and flagged 39 of 152 known-safe controls (vulkro 0.30.0, measured 2026-10-05). The misses are published with the hits. Read the method.
Java is read one file at a time.
A value that leaves a method is not followed into another file, so a Java vulnerability that crosses files is missed.
PHP, C and C++ are read one function at a time.
Input reaching a dangerous call inside the same function is proven; a value that leaves the function is not followed.
It is not a penetration test.
It reads code, metadata and settings and names the weak spot with its file and line. It does not attack a running application or org.

See the attack paths in your own code and org.

Get startedTalk to us