Ship code your customers can trust.
An offline security scanner (SAST) for your code and your Salesforce org. It finds real vulnerabilities, shows the attack path behind each one, and never uploads your code, even air-gapped.
Ten minutes to the first result. Free needs no account; the 14-day trial of the full product needs no card.
- checkout.py:214order_lookup()reads order_id from the request
- services/orders.py:88lookup_order()passes it on unchangedno access check
- db/query_builder.py:41where_clause()pastes it into the SQL textno access check
- db/session.py:57cursor.execute()runs the assembled statementCRITICALSQL injectionVULK-1042
4 hops. Nothing checks the value between the request and the database.
Impact
Reachable from 3 entry points
- GET/orders/lookup
- GET/orders/export
- POST/orders/search
Every vulnerability, with its attack path.
Most scanners match patterns and leave you to sort the pile. Vulkro maps the ways into your application, follows the data, and reports a vulnerability only with the path that shows it is real. In the published test, 62% of what it flagged was real, and the misses are published too.
Maps every way in
Every route, handler, job and command a user or another system can reach, and whether each one checks who is asking.
Follows the data
From the request, across files and functions, to the database, the file system and the shell. A missing check on the way is the vulnerability.
Proves it, then ranks it
A problem is reported as proven only when the path is complete. The rest is marked unproven or not checked, never mixed in.
Air-gapped SAST: nothing leaves your machine.
Every check runs on your own computer, and the same code always gets the same answer. Nothing to upload, nothing for your security team to approve.
What stays
The code it reads, the map it builds of your application, and every problem it finds. All of it on your disk.
What leaves
One daily licence check carrying a handful of usage counts. Never your code, never a file name, never a finding.
The air-gap switch
Turn it on and nothing leaves at all, not even the update check. Vulnerability data arrives as a checksummed bundle, and the licence is a file.
What it finds, and how well.
The vulnerabilities behind real breaches, in Python, JavaScript, TypeScript, Go, Java, C, C++ and PHP, and in Salesforce with the Salesforce edition.
Injection
Database queries, shell commands and templates built from something a user typed.
Broken access control
Records, fields and pages anyone can reach by changing a number in the address.
Leaked secrets
Passwords and keys left in the code, or in git history.
Vulnerable packages and infrastructure
Known bugs in the npm and PyPI packages you use (Go, Cargo and Maven with the wider bundle), plus risky Terraform, Kubernetes and Docker settings.
Salesforce
Who can see which records and fields, sharing, guest access, Flow and Apex, and the org settings a reviewer reads.
Evidence for auditors
What you ship (SBOM), which known bugs affect it (VEX), and control-by-control evidence for SOC 2, PCI, HIPAA, GDPR and ISO 27001.
| Result | |
|---|---|
| Real vulnerabilities found | 33 of 83 |
| Vulnerabilities it missed | 50 |
| False alarms | 20 |
| Of everything it flagged, how much was real | 62% |
| Time to check every application | 36.3s |
Measured on vulkro 0.25.3, 2026-09-08, at the setting we recommend for stopping a release. Fixed test sets flatter every tool, ours included. The only benchmark that matters is your own code.
Salesforce: pass AppExchange Security Review the first time.
Vulkro for Salesforce reads what your team built on Salesforce, plus the org settings, the way an AppExchange Security Review reads them, and gives you the readiness checklist before you submit. A failed review costs another submission fee and weeks of waiting; a ten-minute check on your own machine does not. Vulkro Red, a red team on the same engine that shows which problems an attacker would actually use, is coming soon.