Desktop console

vulkro serve starts a local web app on 127.0.0.1:8723 and opens your browser. Your work (projects, scans, triage, settings) is saved to SQLite on disk, so it survives Ctrl-C.

Launch

vulkro serve              # build UI + run release server, opens browser
vulkro serve --port 9000  # bind to a different port
vulkro serve --no-browser # don't auto-open

Where state lives

OS	Path
macOS	~/Library/Application Support/Vulkro/vulkro-desktop.db
Linux	~/.local/share/Vulkro/vulkro-desktop.db
Windows	%APPDATA%\Vulkro\vulkro-desktop.db

Schema: SQLite, projects -> scans -> findings -> triage notes.

Tabs

The tabs are organised into six top-level groups: Overview, Code, Security, Supply chain, Activity and More. Click a group in the primary nav to reveal its sub-tabs.

Group	Tab	What it shows
Overview	Overview	Scan summary: severity mix, top risks, and jump-offs into every other tab.
	Risk ranking	The riskiest endpoints and modules, ranked by the findings on them.
Code	File scorecards	Per-file rollup of findings, churn, and risk score.
	Codebase map	Structure and dependency map of the codebase, with the security-relevant paths highlighted.
	Change impact	Blast radius: which modules have the widest change-impact and which of those carry open findings.
	API endpoints	Filterable, sortable table of every detected endpoint with auth status, framework, source location.
	Frontend calls	Calls the frontend makes to the API, with orphan (no matching endpoint) detection.
	Import graph	Module dependency graph: cycles, and fan-in / fan-out hubs.
	Data access map	Endpoint to ORM-model to database-table mapping, with a read/write breakdown.
	Data flow map	How untrusted input reaches risky sinks, traced per endpoint.
	GraphQL, gRPC and WebSockets	Non-REST surface detected in the code.
	API docs	The inferred OpenAPI spec: documented vs undocumented endpoints.
Security	Findings	Master list of every finding. Group by severity, OWASP category, file, or owner. Secrets, git-history secrets and dependency CVEs are folded in as source facets.
	Changed code	Findings on the working tree or last commit (the vulkro review surface).
	Access matrix	RBAC matrix of roles against endpoints.
	Secrets in code	Hardcoded secrets (current tree).
	Secrets in git history	Secrets ever committed.
	API spec score	Score against the inferred spec; gaps and inconsistencies.
	Compliance	Pass/fail per control across the frameworks.
	Compare scans	Per-finding delta between two scans of the same project.
Supply chain	Dependencies	Package inventory with CVE matches, KEV/EPSS decoration, reachability tags.
	Known vulnerabilities	One row per (package, advisory): published CVEs affecting your dependencies.
	Licenses	Package-licence inventory + flagged copyleft / unknown licences.
	Containers	Findings from container-image scans.
Activity	Trends	Risk-score, finding-count, MTTR, risk-debt over saved scans.
	Hotspots	Sortable heatmap of churn x risk per module.
	Contributors	Top contributors, bus factor per module, ownership coverage.
	Test coverage	Coverage percentage and the files left uncovered.
	Quality trends	Complexity and code-quality metrics over saved scans.
More	Project settings	Branch picker, run-scan controls, KPI strip, and the danger zone.
	Environment variables	Referenced vs defined environment variables.
	Raw scan data	The scan JSON exactly as the scanner produced it.

What is Free and what is Pro

The console on this machine, on the active repository, is Free, and so are the findings, endpoints, dependencies, secrets and triage tabs. The views that turn one scan into a picture of the whole application are Pro: Attack paths, Impact, the Changes view, the data-flow and code-structure maps, History, Trends, Compare scans, Hotspots and Contributors, Git history (secrets that were committed and then removed), OpenAPI, Compliance, Containers and Portfolio. A network bind for a shared team console is Pro too.

Each Pro view opens three times on Free before it locks, so you can see what it adds on your own code. The lock line names the capability and links to Pricing, which lists every one in the scanner's own words.

Triage workflow

Mark any finding as one of:

• triaged - looked at, not yet decided.
• accepted-risk - known issue, deliberately won't fix.
• false-positive - not a real bug.
• wont-fix - real but de-prioritised.

Triage state carries across scans (matched by a stable finding_key), so a suppression you set doesn't come back next scan. Bulk-triage from the FilterBar, or export to vulkro-suppress.yaml to keep triage in source control.

Re-scan

Click Re-scan to trigger POST /api/scan on the embedded server. Handy while iterating: change code, hit Re-scan, and see the deltas without leaving the browser.

Quick Sync (CVE Database view)

The CVE Database is its own view in the sidebar, not one of the per-scan tabs above. Click Quick Sync there to run the same path as vulkro update (CDN fetch, signature verify, atomic apply). Useful when CI dropped the bundle and you want fresh CVE data without leaving the browser.

Related

• vulkro serve
• See also: Baselines explained - when the UI's baseline-scan flag applies vs the CLI's .vulkro-baseline.json file, and how the Export-for-CI button bridges the two.