Skip to main content

Accounts, Free and Pro

No account is needed to scan. Install Vulkro and run it: every language, every finding with its proof, the fix, and current vulnerability data, on one repository at a time. That is Free. It is permanent, it never expires, and it never asks you to sign in.

An account holds Pro, nothing else. Pro is a set of named capabilities on top of Free: the application-wide maps, the diff-scoped release gate, the pull-request output, the evidence packs, every repository at once, and the live-org Salesforce audit. The full list, with the same words the scanner uses, is on the pricing page.

Scanning always runs on your machine. Your code and your findings never leave it. The account layer sends only a short device token and anonymous usage counters over the network (see Telemetry).

What Free is​

  • One repository at a time. Every language, every detector, every finding with its severity, its proven / unproven / not-checked disposition and the data-flow hops behind it, explain and prove on any finding, the deterministic fix and the AI fix.
  • Current vulnerability data. The CVE bundle updates on the same schedule as Pro, air-gapped bundle installs included.
  • The local console, the editor extension, the coding-agent skill, the guard hook and the MCP server, on the active repository.
  • A few free looks. Each Pro view in the console and the editor opens three times on Free before it locks, so you can see what Pro adds on your own code.

Nothing on Free depends on the network. vulkro scan, vulkro serve, vulkro explain and the rest run without ever having signed in.

What Pro adds​

Pro is scale and operation: the attack-path and impact maps across the whole application, working-tree review, the diff-scoped release gate and the pull-request output, the evidence formats and reports, portfolio and the shared console, and every live-org Salesforce command. Run vulkro license-status for the checklist on this machine, or see Pricing for the whole matrix.

A Pro command run on Free stops before it does any work, prints what it needs and where to get it, and exits 1. Exit 2 stays reserved for real errors.

The 14-day term​

The first verified device login on an account starts a 14-day term of the full product. The term is issued by the server; there is no local trial, and nothing starts until a device has signed in and been verified. After the term, licences are issued directly by our team: email license@vulkro.com. There is no self-serve checkout.

Sign in: vulkro login​

There are three ways in, tried in this order:

vulkro login                    # browser login (default)
vulkro login --code ABCD-1234   # paste a pairing code, no browser
VULKRO_ACCOUNT_TOKEN=... vulkro login   # CI / headless, no browser
  • Browser login (vulkro login, no arguments). Vulkro prints a short code (for example ABCD-1234) and opens your browser to the account console. Approve the code in a logged-in tab and the lease installs. If no browser can open, it prints the URL to open by hand. The wait is bounded (about 15 minutes). A denied, expired, or timed-out login exits 2 and changes nothing.
  • Pairing code (vulkro login --code <CODE>). Paste a code from app.vulkro.com/connect instead. Use it on headless machines or when no browser is available.
  • CI / headless. Set VULKRO_ACCOUNT_TOKEN to a stored device token and run vulkro login with no --code. It swaps the token for a lease, with no browser and no code.

All three install the same signed lease. Exit codes: 0 logged in and lease installed; 2 error (offline, account-server failure, an invalid lease, or a denied / expired / timed-out browser login).

The lease and offline grace​

Login installs a short-lived signed lease that carries your Pro entitlement. The scan itself is unchanged and still runs fully offline against the cached lease.

  • The lease refreshes automatically once a day while online.
  • It stays valid offline through its signed expiry (about 14 days), so short offline stretches (travel, flaky networks) never interrupt work.
  • Once that expiry passes without a refresh, the machine returns to Free until it can refresh, you log in again, or you activate a .lic. Scanning continues throughout.

The refresh call carries only this device's token and anonymous usage counters. Never your code, your findings, or your machine fingerprint.

When Pro lapses​

A lapse never stops the scanner. When a term ends you get renewal reminders, then a grace window, then the machine drops to Free and keeps scanning: the most recently scanned repository keeps working, and vulnerability data stays current. Reports, scan history and settings already on disk stay yours.

Only two states still hard-block a scan, and both are about the lease file itself rather than the term: an invalid signature, and a detected clock rollback. Each prints what it found and how to recover.

Check your state: vulkro account and vulkro license-status​

vulkro account                          # local view: tier, seat, expiry, offline grace
vulkro license-status                   # sign-in status, expiry, machine ID, the Pro checklist
vulkro license-status --format json     # the whole capability matrix, machine-readable
  • vulkro account is fully local. It reads only your local database and makes no network call, so it works air-gapped. It shows your tier, your seat (for example "seat 2 of 5"), the lease expiry, and the offline grace remaining. Exit codes: 0 printed, 2 local read error.
  • vulkro license-status shows the current licence state and the Pro checklist: every Pro capability, generated from the registry compiled into the scanner, with whether this machine has it. --format markdown and --format json emit the whole matrix (Free and Pro, both products). It needs no account to run. Exit codes: 0 printed, 2 local database error.

Sign out: vulkro logout​

vulkro logout

This deletes the local device token and cached lease, then tries to revoke the seat on the account server. Local logout always succeeds; a failed or offline revoke is a warning, not an error. A perpetual offline .lic you installed with vulkro activate is left untouched and keeps working. After logout the machine is on Free, and scanning continues. Exit codes: 0 logged out (or nothing to do), 2 local database error.

Air-gapped and offline machines​

Machines that cannot reach the internet hold Pro through a licence file instead of vulkro login:

vulkro activate ./your-team.lic   # install a signed .lic (replaces login)
vulkro machine-id                 # print this machine's fingerprint

vulkro activate verifies the Ed25519 signature, checks the machine binding, and stores the key locally. Run vulkro machine-id to get the fingerprint to send when requesting a licence file. See Offline mode for the full air-gap workflow. Free needs no file at all: an air-gapped machine that never activates anything still scans one repository at a time, and can still apply the vulnerability bundle you carry in.

With VULKRO_OFFLINE=1 set, vulkro login and vulkro logout refuse to run (no outbound call) and point you at the .lic path. vulkro account still works.

Environment variables​

VariableEffect
VULKRO_ACCOUNT_URLOverride the account / API base. Defaults to https://app.vulkro.com/api. Useful for self-hosting or testing.
VULKRO_ACCOUNT_TOKENSupply a device token non-interactively so vulkro login (with no --code) can pair a headless / CI machine without the browser flow.
VULKRO_OFFLINE=1The air-gap switch. Disables login, the lease refresh, and every other outbound call, guaranteeing zero egress.

What's next​

Last updated on