Security research
The research behind every finding.
How apps and Salesforce orgs get attacked, how Vulkro decides a finding is real, and the benchmark we publish with its misses.
01Guides
How orgs and packages get attacked.
Practical guides for Salesforce teams and package builders, plus the recent attacks behind them.
- Apex CRUD and FLS, the top review failureWhat a reviewer checks, and the fixes that compile.Guide
- AgentExchange Security Review readinessThe review checklist, section by section, before you submit.Checklist
- The AgentExchange top 20The most common review failures, each mapped to its check.Reference
- How Salesforce breaches happenReal incidents, mapped to the settings and code that allowed them.Map
- What you deployed versus what is liveWhy the two drift apart, and what to check in each.Concept
- Scanning a package before it shipsA full security scan of an unreleased package, on your own machine.Guide
- Why now: recent attacks and EU lawEach recent attack with the check that flags its root cause.Briefing
- Use casesNine scenarios, each from the first scan to fixed.Guide
02Method
How Vulkro decides a finding is real.
The reasoning behind every result: how a path is built, how sure Vulkro is, and where the analysis stops.
- Attack pathsHow a way in, a missing check and the data at risk become one path.Method
- How sure Vulkro isProven, unproven and not checked: what each one means.Method
- ReachabilityWhether vulnerable code can be reached from where an attacker starts.Method
- Following untrusted inputHow a value is traced across functions and files, and where it stops.Method
- What is being exploited nowRanking known vulnerabilities by real-world use, not only by score.Reference
- Code written by AI assistantsThe patterns they introduce, and how each one is checked.Reference
- What each language getsWhich languages are read, and how deep the analysis goes in each.Reference
- Security answers without wasting tokensWhy Vulkro answers your AI assistant instead of it reading the codebase.Principle
03Benchmark
Measured on apps it had never seen.
9 test apps, kept unread by the people who build the engine, with vulnerabilities planted in them and safe code that should stay quiet.
The result and the methodPlanted vulnerabilities
181 of 229 found
48 missed, and kept in the score.
Safe code flagged by mistake
39 of 152
False alarms, published beside the finds.
Measured with vulkro 0.30.0 on 2026-10-05; later releases have not been re-measured. Real Criticals rated Critical: 32 of 90. What changed in each release is in the changelog.
04From the blog
Recent writing.
- ResearchThe attacks of 2025, and the checks that flag their root causesTwelve incidents, from Salesforce guest sites to poisoned npm packages, each with the Vulkro check that flags the weakness behind it.
- EU lawThe EU Cyber Resilience Act is live: what software teams must do nowThe 24-hour and 72-hour reporting clocks, SBOMs and security updates, and the evidence Vulkro produces toward them.
- ResearchHow Salesforce orgs get breached, shown as attack pathsThe 2025 and 2026 data thefts used trust the orgs had already granted. Three paths, and the cheapest place to stop each.
- Token efficiencySecurity analysis without wasting tokensWhy an agent reading a repository for bugs uses up its context, and what to give it instead.