Skip to main content

vulkro report

Pro

vulkro report is part of Pro: Executive report (report), the PDF and HTML report you hand to someone else. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Render an offline executive HTML report. Open it in a browser to read, or save as PDF for distribution. The report is rendered entirely from your local scan data and is self-contained: no CDN, no fonts, no scripts fetched at open time.

Usage​

vulkro report [PATH] -o report.html
ArgumentDescriptionDefault
PATHPath to the project root..

Flags​

FlagDescription
--profile <PROFILE>Compliance profile to include: owasp-asvs, pci, soc2, hipaa, nist-ssdf, iso27001, cis, cwe-top25.
--output, -o <OUTPUT>Write to a file instead of stdout.

Examples​

# Executive HTML to a file.
vulkro report . -o vulkro-report.html

# Include a SOC 2 control mapping.
vulkro report . --profile soc2 -o soc2-report.html

To produce a PDF, render the HTML in a browser and print to PDF, or use vulkro scan . --format pdf (which requires wkhtmltopdf on PATH).

Command reference​

Generated from vulkro help report on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Build an executive HTML report you can open in a browser or save as PDF.

[Pro] Render an offline executive HTML report (open in browser, save as PDF).

The counts match `vulkro scan`: the same default confidence floor and unreachable-code suppression are applied. `--all-confidence` reports the raw pool instead, and the report labels the number with both figures so the two surfaces never disagree silently.

Exit code: 0 report rendered (to stdout or `--output`), 2 scan / IO error. The report renders findings but does not fail on them, so it never returns 1.

Usage: vulkro report [OPTIONS] [PATH]

Arguments:
  [PATH]
          [default: .]

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --profile <PROFILE>
          Compliance profile to include (owasp-asvs | owasp-web | pci | soc2 | hipaa | nist-ssdf | iso27001 | cis | cwe-top25)

      --all-confidence
          Report every finding instead of the set `vulkro scan` shows by default. The report labels the number

  -o, --output <OUTPUT>
          Write to file instead of stdout

  -h, --help
          Print help (see a summary with '-h')
Last updated on