Offline and air-gapped SAST
A SAST tool that runs fully offline, for air-gapped networks.
Code analysis, dependency checks and vulnerability matching all run on the machine that holds the code. Your source is never uploaded, and one switch closes the network completely.
No source upload · no network needed to scan · offline licence file
The machine that holds the code
- Source and configurationread in place
- The analysisstatic, deterministic
- Vulnerability archivechecksummed, carried in
- Findings and reportswritten to your disk
Vulkro
Receives the usage call and, on a signed-in machine, a licence refresh carrying only the device token. Nothing derived from your code. Turn them off and this line does not exist.
VULKRO_OFFLINE=1 refuses every outbound call at the process boundary.
01What offline SAST means here
Offline, with no asterisk.
Many scanners call themselves offline. These are the four specific things we mean by it, so you can check each one.
Every outbound call, itemisedYour code is never uploaded
Detection runs on your machine, and the scanner has no option that sends code away for deeper analysis. For a team workspace, run Vulkro Cloud on your own servers: talk to us.
Two small background calls, shown in full
Two calls are on by default: a usage call at most every six hours (and at most hourly after a scan), and on a signed-in machine a licence refresh that sends only the device token. Neither carries a path, a finding or a line of source, and you can turn both off.
Licensed offline
A machine that never reaches the network runs from a signed offline licence file, created in your portal or issued on request at license@vulkro.com.
One switch blocks every call
The process then refuses every outbound connection, and vulnerability data arrives by disk or internal mirror.
The vulnerability archive is signed and checksummed: its signature is checked against the key built into the scanner, and every file's checksum before anything is written. On a disconnected machine it is as current as the copy you carried in. Eight manifest formats are parsed. The default published bundle currently ships npm and PyPI; the wider signed bundle covers the other six. How to build and move it is in the offline vulnerability matching guide.
02The usage call
Everything that leaves, field by field.
We will not write “no telemetry”, because it would be untrue. Two background calls are on by default. This is the whole body of the usage call; the other, a licence refresh on a signed-in machine, sends only the device token.
- On an anonymous run
- Seven fields on every call. Twelve at most: the other five are a device token while you are signed in, the language names seen in the last scan, the command names run since the last call, and the editor and its version when the VS Code extension started the scan.
- Never in it
- Source, paths, file or project names, findings, or anything that fingerprints the machine.
- How often
- At most every six hours in the background, and at most once an hour after a scan, so a burst of scans adds one call.
- Turned off
- Zero egress: either switch stops both background calls. A machine running from an offline licence file has no lease to refresh.VULKRO_OFFLINE=1 · VULKRO_NO_HEARTBEAT=1
- "product": "vulkro",which binary made the call
- "install_id": "3f9c1a7e-5b40-4c8d-9a21-7ce4d0b28f16",a random id minted at install, not a hardware fingerprint
- "version": "0.30.0",the build that is running
- "os": "macos",operating system family, not a machine name
- "license_state": "licensed",the install's own view of its licence: trial, licensed, grace, expired and so on
- "timestamp": "2026-10-05T09:41:02Z",when the call was made
- "scans_since_last_heartbeat": 4how many scans ran since the last call
Added only when they apply
- device_token (signed in)
- languages (last scan)
- features (commands run)
- editor
- editor_version
Never in the body
- source code
- file paths
- file names
- project names
- finding contents
- hardware fingerprint
03One binary
One binary instead of four tools.
A disconnected network is the worst place to keep four tools and four data feeds current. One download covers all of it.
How this compares, by category- Code
Your application code
Broken access control, injection and missing authorisation, found by following untrusted input to the call that trusted it.
Learn more → - Secrets
Secrets, even removed ones
Across the working tree and the commit history behind it, because deleting the line never deleted the credential.
Learn more → - Infrastructure
Infrastructure and containers
Infrastructure definitions, container build files, and the packages baked into built images.
Learn more → - Dependencies
Dependencies, matched on your disk
Lockfile versions matched against local data, ranked by whether your own code reaches the affected function.
Learn more →
Code analysis covers 8 languages: JavaScript, TypeScript, Python, Go, Java, PHP, C, C++. Values are followed across files in JavaScript, TypeScript, Python, Go and Java; PHP, C and C++ are read one function at a time. There is no Ruby, C# or Kotlin parser. Salesforce Apex is covered by Vulkro for Salesforce. Nothing is executed or probed: this is a read of your code and configuration, not a penetration test. Details in the supported detection reference.
04Measured accuracy
Measured offline, misses included.
9 blind test apps the engine team never reads, with planted vulnerabilities and code that is safe on purpose, scanned with the network switched off.
The full result and the methodPlanted vulnerabilities found
181 of 229
79%. Measured with vulkro 0.30.0 on 2026-10-05; later releases have not been re-measured.
Missed
48
Kept in the score rather than removed from it.
Safe code flagged
39 of 152
False alarms, published beside the finds.
vulkro 0.30.0, measured 2026-10-05. Real Criticals rated Critical: 32 of 90. No other scanner was run on these apps: this compares Vulkro with its previous release.