About
Security tools that show their work.
Vulkro finds the weak spots an attacker could actually reach in your code and your Salesforce org. It shows step by step how they would get in. It is a product of Reveriext.
A product of Reveriext
01What we make
One engine, wherever you work.
The editor, the command line, the pipeline and the team workspace run the same checks, so they agree on every finding.
- 01Vulkro CoreYour application code, and the weak spots an attacker could actually reach in it.Available
- 02Vulkro for SalesforceYour Salesforce code, settings and permissions, read as one system.Available
- 03Vulkro CloudEnterprise security for code and Salesforce: your repositories and every org your team runs, scanned on a schedule, in one workspace.14-day trial
- 04VS Code extensionThe finding on the line that causes it, while you write it.Available
- 05Vulkro RedThe same engine, chaining findings into a break-in, each stage citing a file and a line.Coming soon
Alongside them, Vulkro Labs is a set of free tools that check packages, dependency files and agent tooling before they reach your project. Labs is separate from the licensed Vulkro scanner and runs without a Vulkro plan.
02How we build it
Built to be checked, not taken on trust.
A tool that reads your source or your org has to earn that. Each of these can be checked by the person who approves it.
How it works- 01Runs on your machineThe command line and the editor scan where your code already is. It runs offline, and your code is not uploaded to scan it.Vulkro Cloud is the hosted option: each repository scanned in an isolated container, Salesforce orgs read-only, in a workspace of your own.
- 02The same answer every timeNo AI in detection. The same code gets the same answer, in the same order, on any machine.So a result can gate a release without surprising anyone.
- 03Proven, or labelledA finding is called proven only when the whole path is shown. Anything less says so, and nothing unchecked counts as a pass.Proven, Unproven and Not checked, on every finding.
- 04Closed source, published methodThe engine is the licensed product. How we measure it, and where it falls short, is public.The benchmark, its scoring and its known weak spots.
03What we publish
Our benchmark, misses included.
Scored on 9 blind applications the engine team never reads, each with planted vulnerabilities and code that is safe on purpose.
Benchmark and method- Found
- 181 of 229planted vulnerabilities (79%)
- Missed
- 48 of 229published beside the finds
- Criticals rated Critical
- 32 of 90the weakest number (36%), printed anyway
- Safe code flagged
- 39 of 152known-safe controls (26%), counted as false alarms
Run offline and deterministically on blind test apps. Measured with vulkro 0.30.0 on 2026-10-05; later releases have not been re-measured. How we measured.
04The company
A product of Reveriext.
Reveriext is an engineering company that builds production systems on Salesforce, the major clouds and the data underneath. Every address below is read by a person.
- Parent company
- Reveriext Inc., Delaware, USA
- Billing entity
- Reveriext Solutions LLP, Hyderabad, India
- Website
- reveriext.com
- Licences
- license@vulkro.com
- Billing
- billing@vulkro.com
- Security
- security@vulkro.com, under the security policy