14-day trialVulkro Cloud · Code
Every repository and branch, checked before it merges.
The code app of Vulkro Cloud scans the repositories you connect, branch by branch. It holds every scan against a quality gate and reports the result on the pull request, where your team already reviews code.
Connect with an access token. Each scan runs in a container of its own. We set up your workspace within two business days, with a 14-day trial.
- Every branch you trackEach one keeps its own issues, history and gate result. Switch from the header.
- Passed or failedEach scan is held against your quality gate. The default fails on a new Critical, a new High or a new secret.
- What started each scanThe schedule, a push, a pull request or a person, with the gate result beside it.
01Connect
Connect a repository with an access token.
Paste the repository's https address and a token from your git host, then choose the branches to track. A public repository needs no token.
- GitHubCommit status, a summary comment and comments on the changed lines of each pull request.
- GitLabCommit status, a summary comment and comments on the changed lines of each merge request.
- BitbucketCommit status, comments, and a Code Insights report with each issue on its line.
- Any git hostAny repository you can clone over https, scanned on a schedule. Servers you host yourself from the Business plan.
- Tracked branchesChoose the branches to keep. Each one gets its own issues, history and gate result.
- On a scheduleEvery 6 hours, daily or weekly, per branch, within what your plan allows.
- On every pushYour git host tells Vulkro Cloud about each push through a signed webhook, and the branch is scanned. On every Vulkro Cloud plan.
- A token for each repositoryA token is kept for its own repository and used only for what you turn on there.
02Gates and pull requests
A clear pass or fail on every pull request.
Each pull request is scanned and held against the quality gate of its target branch. The result shows on the pull request itself, so nobody has to open another tool to see it.
- One summary commentNew issues by severity, the gate result and a link to the scan. Updated in place on every new commit.
- Comments on the changed linesEach new issue on a line the pull request changed, with why it matters and how to fix it.
- A status beside your own checksPassed or failed, so your branch rules can require it before a merge.
- Quality gatesConditions on new Critical, High or Medium issues, new proven issues, new secrets and open issues. The default gate fails on a new Critical, a new High or a new secret.
- One gate or severalOne default gate for the workspace, or a gate of its own for a repository that needs a stricter rule.
- Only what is newWith the default gate, a pull request is judged on what it adds against its target branch, so old issues do not block new work.
- Which planQuality gates, scan on push and pull-request checks come with every Vulkro Cloud plan for Core, trial included. Servers you host yourself come with Business and above.
03Each repository
The whole application, for every branch.
Every scan maps the application the way an attacker would see it, not only the list of issues. Each view opens from the repository's Explore menu, and every finding links to the code behind it.
- Attack paths and secretsHow someone gets from an entry point to your data, and the keys and passwords in the code and its git history.Attack Paths · Secrets · Git history
- API and accessEvery endpoint, who can call it, and whether your API specification documents it.Endpoints · API Spec · Access Matrix · Protocols
- Data flow and databaseWhere request data goes, across files to the database, files and shell. The tables, columns and keys, with sensitive columns marked.Data Flow · Data Lineage · Tables · Columns · Relationships
- Code, packages and healthHow the code fits together and what a change would touch, every package with its known flaws and licence, and the files that change most.Structure Map · Impact · Dependencies · Licences · Hotspots · Test Coverage
- Dependencies, checked between scans tooAt every scan, and once a day after it: Vulkro Cloud checks your dependencies against newly published advisories, without a new scan. These lookups send package names and versions to the public OSV vulnerability database (api.osv.dev, operated by Google), never code. An admin can turn them off.
- ExportsFor each branch: an SBOM in CycloneDX or SPDX, VEX, SARIF, CSV and a PDF report.
04Your data model
Your data model, read from the code.
Vulkro Cloud reads your ORM models and migrations, builds the tables and the keys between them, and marks the columns that hold sensitive data. Then it checks the design itself.
- Prisma
- Drizzle
- Mongoose
- TypeORM
- MikroORM
- Sequelize
- Knex
- SQL migrations
- Django
- SQLAlchemy
- Alembic
- Rails
- JPA and Hibernate
- GORM
- ent
- EF Core
- Laravel
- A password column written without hashing
- A token, key or secret column stored as plain text
- A login email or username that is not unique
- A table of sensitive data with no tenant column, when the rest have one
Rails and EF Core are read as schema and migration sources only: Ruby and C# code is not analysed for security issues. Scanning on your own machine? The same data model is part of the scanner's JSON output.
- The tables and their keysDrawn from the models and migrations in the repository.
- Sensitive columns markedPersonal data, money, health data, secrets and credentials.
- A risk in the design itselfHere, a password column that the code writes without hashing.