Everything Vulkro does, in one place.

Finds injection, broken access control, leaked secrets and unsafe configuration in JavaScript, TypeScript, Python, Go, Java, PHP, C and C++.

One engine covers the languages most product teams ship, with the same results on a laptop and in CI.

Vulkro CoreDocs

Decides for each route whether it is authenticated, scoped to the caller and role-checked, and reports lookups by id with no ownership check.

Broken access control needs the route, the guard and the record together; a pattern match on one line cannot see it.

Vulkro CoreDocs

Lists every endpoint, including MCP and AI agent tools, with its handler, full path and the guards that protect it.

You cannot secure a surface you have not listed, and this list comes from the code, not from documentation.

Vulkro CoreDocs

Checks Terraform, Kubernetes manifests, Helm charts and Dockerfiles in the same scan as the application code.

Misconfiguration in deployment files is often how a code flaw becomes reachable from outside.

Vulkro CoreDocs

Maps your database tables and columns from the ORM models and migrations in the repository and marks the sensitive columns. Flags a password or secret stored in plain text, a login name that is not unique and a sensitive table with no tenant column.

The data model shows what a flaw can reach, and a plain-text password column is a breach waiting for one query.

Vulkro CoreDocs

Opt-in packs for business logic, money handling, state machines and concurrency, a deep preset, and import of private rule packs.

Application-specific flaws and in-house rules run when you ask for them, in the same results and gate.

Vulkro CoreDocs

Scans Apex, LWC, Aura, Visualforce, Flows and metadata in an SFDX project, or metadata alone from a retrieved org.

Security review starts before a change reaches an org, including in orgs built with clicks rather than code.

Vulkro for SalesforceDocs

Works out how each Apex class and method really runs, user or system mode, with or without sharing, along the call stack.

Record exposure depends on the mode code actually runs in, which inheritance and API version change.

Vulkro for SalesforceDocs

Reports queries and DML that skip object and field checks, and recognises user mode, stripped fields and your own security helpers.

CRUD and FLS enforcement is a core Security Review requirement, and false alarms waste review cycles.

Vulkro for SalesforceDocs

Checks agent actions that take record ids from user input, act without confirmation, or pass model output into queries and DML.

An agent action is a new entry point, and prompt injection turns it into a data exfiltration path.

Vulkro for SalesforceDocs

Write, scaffold, validate and test your own rules over Apex syntax, XML metadata or text, and load them in every scan.

Each org has its own policies, and they belong in the same scan as the built-in checks.

Vulkro for SalesforceDocs

Finds queries and DML in loops, hardcoded record ids, empty catch blocks and other Well-Architected anti-patterns in Apex.

Governor-limit and reliability problems cause production failures that look like security incidents.

Vulkro for SalesforceDocs

Connects the git repository of your Salesforce project and shows code findings, anti-patterns, flows, test coverage gaps on attack paths and release readiness. On every Vulkro Cloud plan.

Code risk sits next to org posture, so a path through untested Apex is visible in the same workspace.

Vulkro CloudDocs

The Database area lists every table and column found in the ORM models and migrations, draws how the tables relate, and marks the sensitive columns.

Knowing which tables hold credentials and personal data tells you what a flaw can reach.

Vulkro CloudDocs

Tags each finding with whether an entry point reaches it, and can limit results or the build gate to reachable findings.

Unreachable code is real debt but rarely urgent; reach is what separates the two.

Vulkro CoreDocs

Maps every entry point to every sensitive sink across the whole application, in the console and the editor.

A list of findings says what is wrong; the map says which ones an attacker can actually chain.

Vulkro CoreDocs

Scores what a finding reaches, lists every entry point that leads to it, and maps modules, calls and layering.

Fixes that close the most exposure go first, and you see what depends on code before changing it.

Vulkro CoreDocs

Shows where outside data enters, what it passes through and where it ends up, including calls between your repositories.

Reviewers follow personal and untrusted data end to end, even when it crosses a service boundary.

Vulkro CoreDocs

Generates an OpenAPI specification from the code and prints every endpoint against the login level it requires.

An accurate contract and one access table make an outlier endpoint visible in a single read.

Vulkro CoreDocs

Summarises one application's entry points by authentication state, unauthenticated reach to sensitive code and proven Critical and High findings.

It answers what an anonymous attacker can reach, in a document you can hand to a reviewer.

Vulkro CoreDocs

Joins who can reach the code, the door they use, the grant, the access mode and the data touched, with an entry-point inventory.

A Critical finding comes with a path from a person to your data, each step citing a file and line.

Vulkro for SalesforceDocs

Reads who holds each profile and permission set, connected-app token use and what Salesforce ships, and re-ranks the paths.

A dangerous grant nobody holds is lowered and one held widely is raised, so priority matches the real org.

Vulkro for SalesforceDocs

Per public site, shows what an unauthenticated visitor can read and run, with a verdict and fixes as Setup steps.

Guest access settings decide what anyone on the internet can read from the org.

Vulkro for SalesforceDocs

Shows where a component is used, what breaks if it changes, deployment and merge risk, and maps automations, roles and personal data.

Deployments fail and leak through dependencies nobody remembered; this lists them before the deploy.

Vulkro for SalesforceDocs

Paths, a graph, the attack surface, entry points, an access graph and per-site guest exposure, joining configuration, permissions and code. On every Vulkro Cloud plan.

The issues that form a path from an outsider to sensitive data are the ones to fix first.

Vulkro CloudDocs

Endpoints, the API spec, the access matrix, protocols, data flow and lineage, the structure map, imports, impact and attack paths for each repository. Attack paths are on every Vulkro Cloud plan.

The team reviews how the application fits together in one place, not on one developer's laptop.

Vulkro CloudDocs

One issue for an entry point where weaknesses line up, such as no sign-in, a proven data flow and sensitive data, with the reason in one sentence.

Problems that are minor alone but dangerous together are raised as the one thing to fix first.

Vulkro Cloud

Audits profiles, permission sets, groups and integration users for over-privilege, with per-user least-privilege recommendations.

Over-privileged users and integrations turn one compromised login into full data access.

Vulkro for SalesforceDocs

Rates every connected app and External Client App by scope, policy and who authorised it, and lists recommended revocations.

A connected app holds a standing token into the org; the list is advice and nothing is revoked without you.

Vulkro for SalesforceDocs

Checks MFA, long-lived sessions, login anomalies, IP restrictions, session timeouts and over-broad sharing rules.

Stolen sessions, weak login policy and wide sharing bypass every permission review.

Vulkro for SalesforceDocs

Reads the event logs every org includes, login history and audit trails for activity to investigate, and captures a forensic snapshot for offline analysis.

Suspicious exports and logins are visible in logs most orgs never read, and incident evidence disappears if not taken.

Vulkro for SalesforceDocs

Checks backup configuration, Einstein Trust Layer settings, agent running users, folders open to portal users and credential rotation age.

These are the questions an auditor asks, answered from the org rather than from memory.

Vulkro for Salesforce

Reads the Health Check score, installed packages, named credentials, domain, mail, limits, sandbox lag and trust status.

Configuration drift and unverified packages are quiet ways for an org to fall out of policy.

Vulkro for SalesforceDocs

Produces access recertification worksheets, limits and coverage risk reports, masking rules, and posture trends between audits.

Periodic access reviews are a control requirement, and a generated worksheet makes them repeatable.

Vulkro for SalesforceDocs

Compares two orgs' metadata and reports components that differ or exist in only one, with finding ids a CI job can gate on.

A permission set that drifted between sandbox and production is where testing stops matching reality.

Vulkro for SalesforceDocs

Every user and what an attacker could do as them, sensitive fields and who can read them, login IPs and licence usage.

Access and data questions from auditors and responders get answered from one place.

Vulkro CloudDocs

Least-privilege suggestions per user, review campaigns with assigned reviewers, keep, reduce or remove decisions and a CSV evidence export. On every Vulkro Cloud plan.

Periodic access reviews become a tracked process with evidence, and Salesforce is never changed by the tool.

Vulkro Cloud

Connected and External Client Apps, OAuth tokens and risk, API usage, Agentforce, credentials, remote sites, CORS, packages and single sign-on.

Everything that connects into or out of the org is reviewed together, where token theft starts.

Vulkro Cloud

Keeps each scan's normalised event history, runs baseline rules over it, files detections as issues and alerts on new ones. On every Vulkro Cloud plan.

Spotting what is unusual needs history across scans; a single snapshot cannot show what is unusual.

Vulkro Cloud

Audits the configured org's permission sets for powers such as Modify All Data, through your own Salesforce CLI login.

A developer can check the org a change targets without opening another tool or sharing a token.

VS Code extensionDocs

Every finding is proven, unproven or not checked, with the data-flow steps behind it and a severity set by who can reach it.

Reviewers spend time on findings with evidence, and that evidence is never behind a paywall.

Vulkro CoreDocs

Explains a finding in your framework, and writes runnable test cases that demonstrate eligible injection and authorization findings.

The explanation matches your stack, and a failing test ends the argument about whether a finding is real.

Vulkro CoreDocs

Takes another tool's SARIF results and marks each one proven, not provable with the reason, or not checked.

Teams with an existing scanner can sort its output by evidence instead of re-triaging every alert.

Vulkro Core

Output says what the scan read and did not, and you can ask why nothing was reported at a file and line.

A clean result on code the scanner could not read is the most dangerous false negative.

Vulkro CoreDocs

Each finding says who can trigger it, the door, the access mode, the data flow and the fix guidance in Salesforce idiom.

Admins and developers act on a sentence about their org, not on a generic rule name.

Vulkro for SalesforceDocs

Lists every check with its id, category, default severity, what it looks for and why, and explains suspected misses.

Buyers and auditors see exactly what is covered before they rely on a clean result.

Vulkro for SalesforceDocs

Org audits report whether each check read all, part or none of the org, instead of turning a failed read into no findings.

A clean audit you cannot trust is worse than no audit; the read coverage tells you which one you have.

Vulkro for SalesforceDocs

Prints a suggested patch and remedy per finding for common vulnerability classes, ready for your AI agent or a developer to apply.

A ready patch turns a finding into a reviewable change instead of a ticket.

Vulkro CoreDocs

Scans a temporary copy with a proposed change in place and reports fixed, not fixed or made worse.

The detector, not a model, decides whether a fix worked. Your agent or developer makes the change in your code.

Vulkro CoreDocs

Ask, hunt, explain and triage with a model you choose, local by default; every AI answer is labelled advisory.

AI helps with judgement calls while the deterministic result, its severity and the exit code stay unchanged.

Vulkro CoreDocs

Suggests patches, Setup links and deploy scripts; a suggested Apex patch is shown only when a scan confirms it works.

Admins get the exact change to review, and nothing touches an org without a person deploying it.

Vulkro for SalesforceDocs

Each issue shows the Setup link, the steps and a patch to download; a fix bundle covers many issues at once.

Admins without write access to a repository still get a precise, reviewable change to make, and the org is never changed by Vulkro.

Vulkro Cloud

The lightbulb offers suppress, explain and, for clear-cut patterns, a one-line suggested fix you accept or reject.

Small, certain fixes take one keystroke, and nothing edits your file without your accept.

VS Code extensionDocs

A local model suggests a patch, shown only after a fresh scan confirms the finding is gone and the file parses.

You review a diff the detector has already checked, instead of trusting a model's claim.

VS Code extensionDocs

Fails a build at a chosen severity with a fixed exit-code contract, writes SARIF and JSON, and installs commit and push hooks.

A gate that separates findings from tool errors never turns an infrastructure problem into a silent pass.

Vulkro CoreDocs

Saves today's findings as a baseline and keeps false-positive and accepted-risk decisions in one file the CLI, console and editor all read.

Triage decisions are reviewed in pull requests like code and never have to be made twice.

Vulkro CoreDocs

The local console, in your browser on this machine, for browsing findings, proof and fix guidance on the active repository.

Not everyone who triages lives in a terminal, and nothing leaves the machine to get a visual view.

Vulkro CoreDocs

Fails a build only on findings new since a branch or commit, with a ratchet that never lets the count grow.

Teams can gate every pull request from day one without first paying down every existing finding.

Vulkro CoreDocs

Posts findings as inline review comments and CI annotations on GitHub, GitLab, Bitbucket and Azure DevOps.

The finding appears on the changed line, where the author is already looking.

Vulkro CoreDocs

Shows findings on the lines a change touched, and which endpoints were added, removed or lost protection since a ref.

Reviewers see what this change introduced, including a new public endpoint that no rule fires on.

Vulkro CoreDocs

Keeps every scan, compares any two, shows how findings moved and which files the risk keeps returning to.

Leaders see whether risk is falling, and effort goes where findings keep recurring.

Vulkro CoreDocs

Connects the Salesforce CLI to your Vulkro Cloud workspace to work the ranked queue, triage, start cloud scans and confirm an issue is fixed.

Developers clear the team queue without leaving the terminal, and CI can gate on open issues in the workspace.

Vulkro for SalesforceDocs

A local console that opens on exposure, review readiness, changes and findings, with a data access matrix and an Apex run-mode view.

Admins who do not live in a terminal get the same results, running on their own machine.

Vulkro for SalesforceDocs

Fails a build only on new findings, and reports what a metadata change grants and to whom, on the pull request.

Teams gate every change without blocking on old debt, and permission changes get read as access.

Vulkro for SalesforceDocs

Keeps every scan, compares any two, shows what changed in each org, accepts a baseline and sends daily and weekly digests. Change tracking is on every Vulkro Cloud plan.

Seeing a risky change the next day beats finding it in a quarterly review.

Vulkro CloudDocs

Connects GitHub, GitLab, Bitbucket or any https git host with an access token, or none for a public repository, and scans each tracked branch on a schedule. Self-hosted git hosts are on the Business plan and up.

Every repository the team ships is scanned the same way, with no pipeline to change.

Vulkro CloudDocs

Scans a branch when it is pushed, through a signed webhook from the git host. On every Vulkro Cloud plan.

The result for a change arrives while its author still remembers writing it.

Vulkro CloudDocs

Each branch scan passes or fails a gate you set. By default: no new Critical, no new High and no new secret. On every Vulkro Cloud plan.

A release gate on what is new keeps old debt from blocking every change.

Vulkro CloudDocs

Puts a status, one summary comment and comments on the changed lines on each pull request, with check annotations where the git host supports them. On every Vulkro Cloud plan.

The finding appears on the changed line, with no change to your CI.

Vulkro CloudDocs

Shows which files the risk keeps returning to and which risky code has no tests, per repository.

Effort goes where findings recur and where a change is least likely to be caught.

Vulkro Cloud

Workspace API tokens and a REST API, described by a public OpenAPI 3.1 document.

Your own dashboards, scripts and tools read the workspace without screen scraping.

Vulkro Cloud

One command installs the extension into VS Code, Cursor, Windsurf or VSCodium, in one edition for Vulkro Core and one for Vulkro for Salesforce.

Developers get findings in the editor they already use, from the same engine as CI.

VS Code extensionDocs

Shows findings on open and save, or, in watch mode, on every file change, with the proof tier and proof steps on hover.

A finding fixed while the code is still open costs minutes, not a review cycle.

VS Code extensionDocs

Exports the same whole-project scan CI runs as SARIF or JSON, and checks that the editor view matches your CI settings.

What a developer sees locally is what the pipeline will fail on.

VS Code extensionDocs

Apex, LWC, Aura, Visualforce, Flow and metadata findings inline, with how each class runs and which profiles can call it.

Salesforce developers see sharing and access mode while they write the class, not after deployment.

VS Code extensionDocs

Sidebar views for changes, history, impact, the code graph and trends, next to the default findings views.

Developers review their change and its reach without switching to another tool.

VS Code extensionDocs

Gives Claude Code, Cursor, Windsurf and other MCP clients tools to scan, explain, prove, get fix guidance and check a fix, with the proof chain per finding.

Agents get ranked findings with evidence instead of reading the codebase to search for issues themselves.

AI coding agentsDocs

An agent submits the diff it proposes; Vulkro scans a temporary copy with that change and reports whether the finding is gone.

The detector, not the agent, decides whether a fix worked, before the agent applies it.

AI coding agentsDocs

Scans the whole project but returns only findings on the lines a change added or modified.

An agent checks its own work in one call, with answers small enough to act on.

AI coding agentsDocs

Ranked call graph, blast radius before an edit, a stack trace mapped onto code, and a stable evidence document for any agent.

Agents navigate and change code with ranked, capped answers instead of reading files to find callers.

AI coding agentsDocs

vulkro ctx reads one function, a line range or a large file's outline. It finds every usage of a name and lists what depends on it, for any agent that can run a shell command.

Agents answer in fewer turns and carry less code in their context: 49% fewer turns and 37% less code read on our benchmark.

AI coding agentsDocs

vulkro ctx check runs after an edit and before every commit. It lists call sites left on an old signature, removed names still used and syntax errors, with the tests to run.

Catches the call sites an agent missed whichever model made the change: all 10 broken edits in 62 recorded agent sessions, no false alarms (one Go repository, and the check was tuned on those same replays).

AI coding agentsDocs

Hooks into Claude Code and Cursor to scan every file the agent writes, asking it to regenerate on a proven or High finding.

Scanning becomes part of the agent's write loop, whether or not it decides to ask.

AI coding agentsDocs

Installs a Vulkro skill for Claude Code, Cursor and Codex CLI so the agent knows when and how to run a security review.

The agent reaches for the scanner at the right moments without a long prompt each time.

AI coding agentsDocs

Audits MCP configuration and MCP server source for risky setups and tool poisoning, and inspects a cloned repository before it runs.

Assistant tooling runs with a developer's access, and it is rarely reviewed before it is trusted.

AI coding agentsDocs

The extension registers scan-file and explain-finding tools that GitHub Copilot Chat agent mode can call and you can reference.

Teams on GitHub Copilot get the same engine inside their existing chat.

AI coding agentsDocs

Lets an agent scan an SFDX project or metadata and list every check, offline.

Salesforce developers using agents get platform-aware findings instead of generic code advice.

AI coding agentsDocs

Agents read permissions, sessions, MFA and Health Check through your Salesforce CLI login, and assess a change's blast radius.

An agent can answer what a change will touch and who holds a power, from the real org.

AI coding agentsDocs

An agent lists what to fix, triages, assigns, plans a fix against your local project and verifies it in your Vulkro Cloud workspace.

Agents work the team queue, and their triage proposals still wait for a person to approve.

AI coding agentsDocs

Rolls many repositories into one portfolio, and serves the console on a network address with a token for the team.

A security lead responsible for many services works from one view the whole team can read.

Vulkro CoreDocs

Sends scan summaries to Slack, Microsoft Teams, Jira, PagerDuty and webhooks, updating Jira issues instead of duplicating them.

Findings reach the channel the team already uses, without a ticket flood on every rerun.

Vulkro CoreDocs

Groups projects and orgs under a named client, rolls up risk across orgs, and exports one client-ready report per client.

Consultancies and partners manage many orgs, and each client needs its own clean deliverable.

Vulkro for Salesforce

Scans each live org every 6 hours, daily, weekly or monthly at a time and time zone you choose, or on demand. Daily is the most often on Starter, every 6 hours on Business and hourly on Enterprise.

Posture changes every week; a schedule catches drift without anyone remembering to run a scan.

Vulkro CloudDocs

Every finding of every kind in one list per org, each with a key, status and assignee, closed on rescan when fixed.

Work is tracked once across scans, and a fix is confirmed by the next scan, not by a checkbox.

Vulkro CloudDocs

The org home leads with the most severe open issues to work on next.

A team with limited hours starts with the issues that matter most.

Vulkro CloudDocs

Developers mark issues in progress or fixed at once; a false positive or accepted risk waits for someone else to approve it.

Risk is never waved away by one person, and the decision and approver are on record.

Vulkro CloudDocs

Make any rule advisory or off for some orgs or files, and write custom org and Apex rules tested on the latest scan. Custom rules are on every Vulkro Cloud plan.

Policy is visible and accountable, and company rules are proven against real data before they go live.

Vulkro CloudDocs

Each company gets its own workspace with its own database, storage and keys. Every scan of an org or a repository runs in its own container, with outbound traffic limited to an allow-list.

Your data is separated from other customers by design, and many orgs and repositories never queue behind each other.

Vulkro CloudDocs

Built-in roles from Owner to Viewer and Auditor plus your own, scoped per org or repository, with required MFA, allowed email domains, an IP allowlist and session timeouts. Single sign-on is on the Business plan and up, set up by our team.

Auditors, contractors and developers see only what they need, in a workspace locked down like the org.

Vulkro CloudDocs

Sends events to Slack, Microsoft Teams, Google Chat, Discord, PagerDuty, your mail server, webhooks and Jira. On every Vulkro Cloud plan.

Alerts reach the people on call, where the team already works.

Vulkro CloudDocs

Set result retention, mask personal data (on by default), export the workspace, delete it, grant time-limited support access and keep an activity log. Exporting the activity log is on the Business plan and up.

Security and privacy teams can answer how long data is kept, who saw it and how to get it back.

Vulkro Cloud

Executive, Security, Engineering and Compliance home views, and admins choose which view each role sees.

Each person opens the workspace to the answer their job needs first.

Vulkro CloudDocs

One view across every org and repository in the workspace: open risk, what changed and what is due.

A security lead sees the whole estate without opening each org and repository.

Vulkro Cloud

Each issue gets a due date from its severity, with more time for orgs and repositories marked low criticality; the policy is yours to change.

Everyone knows what is late, and the dates follow a policy instead of a guess.

Vulkro Cloud

Owners come from CODEOWNERS for code and from who last changed an item in Salesforce; teams and auto-assign route new issues to them.

An issue with an owner gets fixed; an issue in a shared queue waits.

Vulkro Cloud

Creates Jira issues in bulk with your field mapping, and reads their status back; a closed ticket marks an issue ready to close, never closed. On every Vulkro Cloud plan.

Work is tracked where engineering already plans it, and the next scan still decides what is fixed.

Vulkro CloudDocs

Builds an HTML report you can open in a browser or save as PDF, worst findings first.

Clients, managers and auditors get a readable document instead of raw scanner output.

Vulkro CoreDocs

Maps findings to controls in ASVS, PCI DSS, SOC 2, HIPAA, ISO 27001, NIST and GDPR, and builds audit and CRA bundles.

Security findings become structured audit evidence without a manual spreadsheet mapping.

Vulkro CoreDocs

Writes CycloneDX and SPDX bills of materials, VEX, a cryptography inventory, an AI bill of materials, PDF, CSV and JUnit.

Procurement, auditors and downstream customers each ask for a specific standard file.

Vulkro CoreDocs

Maps findings to the Security Review categories and pre-submit checklist, and attests Apex test coverage against the bar.

ISVs see where the package stands before submitting, instead of after a failed review.

Vulkro for SalesforceDocs

Builds the readiness report and packet: blocking fixes by effort, drafted false-positive justifications and a bill of materials.

A failed Security Review means another round; a complete, evidenced packet reduces the back and forth.

Vulkro for SalesforceDocs

Builds auditor packages for SOC 2, HIPAA and PCI, a GDPR record of processing, a HIPAA safeguard matrix and hashed attestations.

Compliance teams get evidence generated from the org and code, with a hash to show it was not edited.

Vulkro for SalesforceDocs

Generates a shareable posture report for a live org, and writes audit findings as OCSF events with MITRE ATT&CK techniques, for your SIEM to ingest.

Leadership gets one document, and Salesforce posture joins the rest of your security reporting.

Vulkro for SalesforceDocs

Control status with the issues behind it, hashed PDF and CSV evidence packs, a security report, masked CSV, and OCSF exports for your SIEM. Compliance and evidence packs are on every Vulkro Cloud plan.

Auditors see which open issue fails which control, and results leave in the shape each audience needs.

Vulkro CloudDocs

An internal review view plus the AgentExchange (formerly AppExchange) checklist, report and packet, from the latest scan. On every Vulkro Cloud plan.

ISVs track Security Review readiness on every scan instead of in a rush before submission.

Vulkro Cloud

Per branch: a bill of materials in CycloneDX and SPDX, VEX, a cryptography inventory, a PDF security report, and issues as CSV or SARIF.

Auditors, customers and code-scanning tools each get the standard file they ask for.

Vulkro Cloud

PDF reports, a scheduled Executive Report email and scheduled evidence packs, sent through your own mail server.

Leaders and auditors get the same document on the same day without anyone building it.

Vulkro Cloud

Matches dependencies against offline vulnerability data, tags whether your code reaches each one, and raises known-exploited ones.

A vulnerable library you never call is a scheduled upgrade; an exploited one on a live path is an incident.

Vulkro CoreDocs

Finds credentials committed in the files on disk, with optional live validation that is off by default.

A leaked key can bypass every other control, and it is cheapest to catch before the push.

Vulkro CoreDocs

Flags malicious install scripts in every scan, and surfaces credential theft, reverse shells and obfuscation in source you have not run.

Supply-chain attacks run at install time, before review. Vulkro never certifies code as safe.

Vulkro CoreDocs

Checks dependency lists for malicious, hallucinated and typosquatted names, and installed extensions for risky permissions.

An invented package name is a name an attacker can register, and extensions run with a developer's access.

Vulkro CoreDocs

Finds credentials that were committed and later removed, still recoverable from the repository history.

Deleting a key from the latest commit does not revoke it; anyone with the history still has it.

Vulkro CoreDocs

Lists every dependency in standard bill-of-materials formats, and checks an external one against local vulnerability data.

A current inventory is the first thing asked for when a new advisory lands, including for vendor components.

Vulkro CoreDocs

Checks the operating-system and application packages inside a built image against local vulnerability data, without pulling from a registry.

The image is what runs in production, and it carries packages the source manifests never list.

Vulkro CoreDocs

Answers whether a named package or advisory is anywhere in the project, across lockfiles and imports, in seconds.

When an advisory drops, the first question is whether you are exposed, and it needs a fast, exact answer.

Vulkro CoreDocs

Checks managed packages and JavaScript in static resources against offline vulnerability and end-of-life data, and builds a data dictionary.

Old JavaScript in a static resource is a common, overlooked way to ship a known vulnerability.

Vulkro for SalesforceDocs

Dependencies with their known vulnerabilities and licences, and secrets in the code and in the git history, for each repository.

Supply-chain and credential risk sit next to code findings in the same issue list.

Vulkro Cloud

Checks dependencies against the public OSV vulnerability database at each scan and again once a day without a rescan. Only package names and versions are sent, never code, and a workspace setting turns it off.

An advisory published on Tuesday shows up on Tuesday, not at the next scheduled scan.

Vulkro Cloud

Searches every repository in the workspace for a package and its versions, to answer where you use it.

When an advisory lands, the first question is which services carry the package.

Vulkro Cloud

One flag or environment variable blocks every outbound network call for a run; a local model is still allowed.

Regulated and classified environments need outbound calls off for the whole run, set in one place, not a setting buried in a config file.

Vulkro CoreDocs

Keeps vulnerability data current, and applies updates from an offline file on machines with no internet.

An offline scanner that goes stale is a liability; this one can be updated without a network.

Vulkro CoreDocs

The scan engine calls no model and sends no code anywhere, and the optional AI layer is local by default.

Results can be reproduced, audited and gated on, and detection costs no model tokens.

Vulkro CoreDocs

Source, paths and findings stay on your machine; live-org reads go through your own Salesforce CLI login and change nothing.

No new integration user, no token held by a vendor, and no org data sent anywhere for analysis.

Vulkro for SalesforceDocs