Blog
Security articles on application code, Salesforce orgs and AI coding agents.
How orgs and applications actually get attacked, how attack paths are built, and how to get more security analysis done with fewer tokens. RSS
Developer workflow13 Oct 20268 min readChecking another scanner's findings against a proofvulkro verify reads any SARIF 2.1.0 file and marks each result proven, not provable (with the reason) or not checked, so triage starts with evidence.Read the post →Application security13 Oct 20267 min readSeverity should depend on who can reach the codeThe same SQL injection on a public route and behind an admin login are not the same risk. How Vulkro sets severity from reach, stakes, proof and guards.Read the post →Application security13 Oct 20268 min readUnsigned webhooks and request bodies written to the databaseTwo authorization gaps that look like plumbing: a webhook that trusts whoever calls it, and a handler that writes every field the client sends. How to close both.Read the post →AI coding agents12 Oct 20267 min readDeterministic analysis vs asking a modelWhy asking a language model to find the vulnerabilities is the wrong approach, and where a model genuinely helps once a detector has done its part.Read the post →Compliance12 Oct 20268 min readSOC 2 code scanning evidence, and what it covers for ISO 27001SOC 2 code scanning evidence for CC8.1 and ISO 27001:2022 A.8.25 to A.8.29: what auditors sample, what a scan can honestly show, and what it never can.Read the post →AI coding agents12 Oct 20269 min readVibe coding security: the bugs AI-built apps ship withVibe coding security in practice: the five bugs AI app builders and AI coding agents keep shipping, a pre-ship checklist, and how to scan the app before launch.Read the post →Developer workflow11 Oct 20268 min readFixes you can trust, because each one is checkedA suggested fix is a claim that the bug is gone and nothing new arrived. How vulkro fix --verify tests that claim on a copy of your project, and how an agent can too.Read the post →Application security11 Oct 20269 min readSSRF in Node.js: how a user-supplied URL reaches your cloudSSRF in Node.js explained: how fetch and axios calls with a user URL reach internal hosts and cloud metadata, the fixes that hold, and what a scan can check.Read the post →Application security11 Oct 20268 min readSupply-chain attacks are a code problemThe npm worm, the hijacked packages and the invented ones of 2025 all ran as code on a developer's machine. What to check before a dependency lands.Read the post →Research10 Oct 20268 min readHow to evaluate a SAST tool: a precision-first checklistHow to evaluate a SAST tool on your own code: measure precision of Critical findings, ask what it did not read, check proof, determinism and data handling.Read the post →Application security10 Oct 20269 min readOWASP API Security Top 10: what a source code scan can and cannot findThe OWASP API Security Top 10 (2023) item by item: which risks a source code scan can find, which it only hints at, and what needs runtime testing instead.Read the post →Application security10 Oct 20268 min readYour database schema is a security documentYour models and migrations already say where passwords, tokens and health data live. Vulkro now maps the schema on every scan and checks how those columns are written.Read the post →