Skip to main content

vulkro dataflow

Pro

vulkro dataflow is part of Pro: Data-flow map (dataflow-map), every source-to-sink flow in the project, as one map. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Document data flows. For every input surface (REST endpoints plus events), vulkro dataflow traces the functions and classes the data passes through, the sinks and stores it reaches, and how it is protected (sanitisers) or classified (PII). The result is a connected graph you can render as Mermaid, DOT, or JSON, or as a Markdown document.

By default every input surface is documented ("all flows"); the filter flags below narrow the view. This command documents rather than gates, so it never exits 1.

Usage​

vulkro dataflow [PATH]
ArgumentDescriptionDefault
PATHPath to the project root..

Flags​

FlagDescription
--format, -f <FORMAT>table (default), json, mermaid, dot, markdown. The console Data flow map reads the json form.
--reaching-sinkOnly document flows that reach at least one security-relevant sink.
--sensitiveOnly document flows that carry classified (PII) data.
--min-severity <SEV>Only document flows whose worst reached sink is at least this severe: critical, high, medium, low, info.
--source <SUBSTR>Only document flows whose input-surface label contains this substring (case-insensitive), for example --source /users.
--no-cacheBypass the per-file extraction cache.
--force-appBypass the framework self-scan heuristic (see vulkro discover).
--force-all-rulesBypass the posture-based rule-applicability gate.

Output formats​

FormatUse
tableHuman-readable summary, one row per input surface.
jsonStructured nodes + edges + flows. The desktop console graph reads this.
mermaidMermaid flowchart LR source, paste into a Markdown doc.
dotGraphviz DOT source.
markdownOne documentation section per input surface.

Exit codes​

  • 0 success.
  • 2 argument error or internal failure.

Exit 1 is not used: dataflow documents, it does not gate.

Examples​

# Human summary of every input surface.
vulkro dataflow .

# Only flows that reach a High-or-worse sink, as Mermaid.
vulkro dataflow . --reaching-sink --min-severity high --format mermaid

# Only PII-carrying flows from the /users surface, as JSON.
vulkro dataflow . --sensitive --source /users --format json > flows.json

Command reference​

Generated from vulkro help dataflow on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Map where outside data enters the app, what it passes through, and where it ends up.

Document data flows: every input (REST + events), the functions and classes its data passes through, the sinks/stores it reaches, and how it is protected (sanitisers) or classified (PII). Emits a connected graph (Mermaid / DOT / JSON) or a Markdown document.

By default every input surface is documented ("all flows"); narrow the view with the filter flags below.

Exit codes: `0` success, `2` arg error or internal failure. Dataflow documents rather than gates, so exit `1` is not used.

Usage: vulkro dataflow [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
  -f, --format <FORMAT>
          Output format

          Possible values:
          - table:    Human-readable summary table
          - json:     Structured JSON (nodes + edges + flows)
          - mermaid:  Mermaid `flowchart LR` source
          - dot:      Graphviz DOT source
          - markdown: Markdown documentation: one section per input surface
          
          [default: table]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --reaching-sink
          Only document flows that reach at least one security-relevant sink

      --sensitive
          Only document flows that carry classified (PII) data

      --min-severity <SEV>
          Only document flows whose worst reached sink is at least this severe. One of: critical, high, medium, low, info

      --source <SUBSTR>
          Only document flows whose input surface label contains this substring (case-insensitive), e.g. `--source /users`

      --no-cache
          Bypass the per-file extraction cache (`~/.vulkro/scans.db`)

      --force-app
          Bypass the framework self-scan heuristic (see `discover --force-app`)

      --force-all-rules
          Bypass the posture-based rule-applicability gate (see `discover --force-all-rules`)

  -h, --help
          Print help (see a summary with '-h')
Last updated on