Install
Vulkro is a single self-contained binary. There is nothing to compile and no runtime to install.
Install in one line
macOS and Linux:
curl -fsSL https://dist.vulkro.com/install.sh | bash
Windows (PowerShell):
iwr -useb https://dist.vulkro.com/install.ps1 | iex
The installer picks the right binary for your machine, checks its signature,
installs it to /usr/local/bin (or ~/.local/bin if that is not writable),
and downloads the latest CVE data so dependency scanning works right away.
The first minute
No account is needed. Run the bundled demo project first, so the first run ends with a real finding instead of an empty table:
vulkro demo
Then point it at your own code:
cd path/to/your/project
vulkro scan .
That is Free: every language, every finding with its proof and the fix, and current vulnerability data, on one repository at a time. It never expires.
Pro, and the account that holds it
Pro adds the application-wide maps, the diff-scoped release gate, the pull-request output, the evidence packs, every repository at once, and the live-org Salesforce audit. The full list is on the pricing page. An account holds Pro, nothing else:
vulkro login
The first verified device login on an account starts a 14-day term of the full product, no card required. While signed in, the CLI keeps a signed lease that refreshes about once a day in the background, so short spells offline (travel, flaky Wi-Fi) never interrupt your work. The check only ever confirms your entitlement and counts usage. It never sees your code, your file paths, or your findings. When the term ends the machine returns to Free and keeps scanning.
To keep Pro, request seats from our team at
license@vulkro.com; vulkro buy opens a
pre-filled request email. Licences are per seat per year, per product,
on a fixed term with no auto-renewal.
For the full model, see Accounts, Free and Pro.
Air-gapped install
If the machine cannot reach the internet, ask us for an offline bundle (the binary plus a signed CVE bundle). Free needs nothing else: the scanner runs on one repository at a time with no account and no file. Pro on an air-gapped machine comes as a licence file. On the target machine:
# apply the signed CVE bundle
vulkro update --bundle ./vulkro-cve-<date>.vkbundle
# install the licence for Pro (replaces `vulkro login` on air-gapped machines)
vulkro activate ./your-team.lic
Set VULKRO_OFFLINE=1 and Vulkro makes no network calls at all. The
vulnerability bundle stays current on Free as well as Pro.
Staying up to date
Vulkro never checks for updates behind your back. A plain vulkro scan makes no
network request and shows no update notice. When you want to update:
vulkro update
This checks for a newer version, offers to install it, and then refreshes your CVE data. In CI the prompt is skipped automatically, so pipelines are never blocked.
Installer options
Set these before running the installer to change its behavior:
| Variable | Effect |
|---|---|
VULKRO_VERSION=v0.3.0 | Install a specific version. |
VULKRO_BIN_DIR=/opt/bin | Install somewhere else. |
VULKRO_OFFLINE=1 | Make no network calls, including the first-run CVE download. |
VULKRO_NO_ANALYTICS=1 | Skip the anonymous install ping (product, OS, and version only). |
Scanning Salesforce?
Salesforce code and orgs use a separate product, vulkro-sf, with its own
installer:
curl -fsSL https://dist.vulkro.com/install-sf.sh | bash
See the Vulkro for Salesforce install guide for the full walk-through.