About
A security company that never sees your code.
Two security reviews that run where your code already lives: one goes through your codebase before a release, the other through your Salesforce build. Same answer on the same code, every time.
- Runs on your machine
- Same code, same verdict
- Published test method
- Licensed directly by our team
01 / What we make
A review of what your team built, before your customers see it
Vulkro and Vulkro for Salesforce are the same job pointed at two subjects. Vulkro Red works out what an attacker would do with what the review found.
Reviews your code
Goes through every line of your codebase before a release, the way a senior engineer would if they had the time, and tells you what a customer could exploit.
Reviews your Salesforce build
The same review for the part of your business that runs on Salesforce, including the settings in the org itself, and what the AppExchange security review will ask you for.
Attacks what they found
Takes the review and works out what an attacker would actually do with it: which small problems chain together into a real break-in, and which ones are noise.
One engine behind all three, so the red team works from what the review already foundIt all runs on your machine. Your code never leaves it.
One engine sits behind all of it, so the two reviews never check the same thing twice and nothing falls between them. Compare the two side by side if you are not sure which your team needs.
02 / Why it exists
Three problems that arrived together
None is new on its own. What is new is that all three are true at once in most teams that ship software.
Code is now produced faster than anyone reads it. Review capacity is still people, still finite, and still the first thing dropped when a date slips. The cost of the gap is commercial: a vulnerability found by a customer, a regulator or an attacker is the one that sat on a laptop a month earlier, at a very different price.
A result you cannot reproduce cannot block a release. A tool that returns a slightly different answer on the same code fails a build one morning for no reason anyone can explain, and the team switches it off within a week.
The review has to happen where the code is. Approval to send source code to a third party is harder to win than the budget to buy the tool, so the review never gets run.
Vulkro answers all three in one product: a review fast enough to run on every change, an answer that only moves when the code moves, and an analysis that happens on the machine the code already sits on.
03 / How it is built
Three properties, none of which is a promise
Each can be checked by the person who has to approve the tool.
- It runs where the code already is
- The review happens on your machine, and everything it reads and writes stays there. One small call leaves, carrying licence and usage information only. Switch the product to offline and even that is refused.
- The same code gets the same answer
- Nothing samples and no model decides whether a problem exists. Two runs of the same version over the same code return the same list, in the same order, on any machine. That is the only reason it is safe to put in front of a release.
- The method behind the figures is published
- The engine that finds the problems is the licensed product and is not published. How its accuracy is measured is: what counts as a find, what counts as a false alarm, and the full list of what it missed.
Everything the scan needs stays on your machine: the code it reads, the map it builds of how your product fits together, the findings it writes, and the optional local model it can consult without leaving the machine. One line leaves.
- Stays on this machine
- source code, call graph + taint, findings, account layer, and the local model on 127.0.0.1
- One crossing
- A signed entitlement check and a usage counter, on a debounced cadence.
- Never crosses
- source code, file paths, file names, finding contents, project names, the hardware fingerprint
04 / What we publish
The result, including the half that does not flatter us
Vulkro is scored against real applications whose vulnerabilities are already public. Here is that result.
33 of 83
Real vulnerabilities found
vulkro 0.25.3, measured 2026-09-08
20
False alarms in the same test
Counted and published beside the finds, not netted off
50
Missed, and left in the test
Removing them would raise every figure and measure nothing
Sourcevulkro 0.25.3 · measured 2026-09-08 · Every vulnerability in this test is a real, publicly documented bug in a real application, confirmed by reading the code at that exact version. The ones Vulkro cannot find stay in the test rather than being removed.
The engine is the product and is not published. Everything needed to check the claim is: which applications were tested, what counts as a find, what counts as a false alarm, and every vulnerability the product missed. A figure with no method behind it is marketing.
We also run a separate third-party suite we did not write, kept in its own frame rather than averaged into the headline. The full result, the scoring rules and the known weak spots are on the proof page.
05 / How it is sold
A trial you start yourself, then a licence issued by a person
Evaluate the whole product before anyone talks to you, then a person quotes it.
Free first, then fourteen days of the full product
Licences are issued by our team
Machines with no route out
PricingHow licensing worksInstall and first review
When a licence or trial ends, nothing you produced disappears: reports, history and settings are already on your disk, and the review keeps running on one repository at a time.
06 / Contact
How to reach a person
No form and no chatbot in front of the inbox. Pick the address that matches the question.
- Licences and pricinglicense@vulkro.com
- Seats, renewals, offline licence files, and what a licence covers.
- Procurement and vendor reviewcontact@vulkro.com
- Security questionnaires, data-processing agreements, and anything your security team needs before a tool is installed.
- Product supportsupport@vulkro.com
- Install problems, a finding you think is wrong, and questions about what the product reported.
- Vulnerability reportssecurity@vulkro.com
- A security problem in Vulkro itself. Read the published policy first for scope and what to expect back.
- Invoices and billingbilling@vulkro.com
- Payment questions, licence transfers, and anything on an invoice.
What to put in the messageSecurity policyWhy we built it this way