Use case · Application and API teams
Know every endpoint, and which ones an attacker can reach.
Vulkro reads your routes, shows which ones need a login, and follows request data to the risky call behind each one.
01The problem
Most APIs have endpoints nobody listed.
Attacks often go through a route the team forgot about, or one that trusts the caller too much.
- Forgotten routesDebug routes, hurried additions and tools an AI coding agent can call rarely make it into the spec.
- Signed in is not the same as allowedA route that only checks for a login can hand any user any record whose id they guess.
- Warnings without a pathA flagged query that never shows how request data reaches it leaves you to trace it by hand.
02How Vulkro helps
From the route to the query, step by step.
Each finding starts at the route, follows the request through your code and ends at the call that would run it. You fix the step that matters.
vulkro · orders-apijs-taint-sql-001
Anyone can run their own SQL through the order search
- Entry pointsrc/routes/orders.ts:4
router.get('/api/orders', async (req, res) => {Express route · no sign-in needed - Callsrc/routes/orders.ts:5
const rows = await searchOrders(req.query.q)the search term passed straight on - Sinksrc/services/orders.ts:4
pool.query("SELECT * FROM orders WHERE customer_name LIKE '%" + term + "%'")SQL built from the request, no binding
- Who can reach it
- Anyone, no sign-in
- What is at stake
- Every customer's data
- Guards on the path
- None. The value is never bound
- Disposition
- Proven: traced from the request to the query
- Fix
- Bind the value:
pool.query('... LIKE $1', [`%${term}%`])
A real result: an Express route passes search text to a query built by joining strings. Critical, and proven from the request to the query.
03Why it holds up
Precise, and checkable.
- 0197% of endpoints foundAcross 9 blind test apps, Vulkro listed 378 of 390 expected routes with the right path and method.Blind holdout, vulkro 0.30.0
- 02Honest about limitsOwnership checks Vulkro cannot decide from source are marked Not checked, never passed, and never fail a build.Proven, Unproven or Not checked on every finding
- 03Your code stays with youScans run offline on your machine, with no AI in detection. The same code gets the same answer.No upload, no model in detection