Why Vulkro
Why teams choose Vulkro.
Most security tools hand you a list. Vulkro shows the path an attacker would take, gives every finding a proof status and gives the same answer on every run.
753 Salesforce checks (vulkro-sf 0.28.0) · 8 application languages · no AI in detection
- IdentityGuest userCustomer portal site
- AccessPortal_AccessPermission set
- CodeInvoiceControllerApex · without sharing
- DataBank_Account__cInvoice__c · financial
A guest user can read Invoice__c.Bank_Account__c
- Path
- 4 hops
- Rule
- sf-guest-aura-read-no-fls
- Fix first
- InvoiceController: with sharing
01What is different
A list ranks findings. Vulkro connects them.
Four differences, each one something you can check on your own code.
How the path is builtThe path, not the list
Findings joined into attack paths
A guest user, a permission set and a class that runs without sharing are three Medium findings in a report. Together they show who can read your invoices.
Proof you can check
Every hop, with its file and line
Each finding is Proven, Unproven or Not checked, and says why. Nothing it could not check is counted as a pass.
Code and org together
One system, not two reports
A permission set is only as dangerous as the code it unlocks. Vulkro reads the Salesforce code and the org, and checks who actually holds each permission.
The same answer twice
No AI in detection
The same code gets the same answer on every run, so a change in the results means a change in the code.
Anyone can run their own SQL through the order search
- Entry pointsrc/routes/orders.ts:4
router.get('/api/orders', async (req, res) => {Express route · no sign-in needed - Callsrc/routes/orders.ts:5
const rows = await searchOrders(req.query.q)the search term passed straight on - Sinksrc/services/orders.ts:4
pool.query("SELECT * FROM orders WHERE customer_name LIKE '%" + term + "%'")SQL built from the request, no binding
- Who can reach it
- Anyone, no sign-in
- What is at stake
- Every customer's data
- Guards on the path
- None. The value is never bound
- Disposition
- Proven: traced from the request to the query
- Fix
- Bind the value:
pool.query('... LIKE $1', [`%${term}%`])
02The categories
Compared with kinds of tools, not names.
No vendor is named. Each column is a category of tool, described by what it typically covers. Open a row to see why it matters.
| Open a row to see why it matters | Vulkro Core | Pattern-matching scannersRules that match code shapes, usually file by file. | Cloud code-security platformsHosted scanning, with your code uploaded for analysis. | AI code reviewersA language model reads the change and comments on it. |
|---|---|---|---|---|
| YesOn your machine, air-gapped included; hosted optional | Usually | Rarely | Rarely | |
| YesVulkro Cloud, with a 14-day trial | Sometimes | Usually | Usually | |
| YesNo AI in detection | Usually | Usually | No | |
| YesAcross files in JS, TS, Python, Go and Java | Sometimes | Sometimes | Rarely | |
| Yes | Rarely | Sometimes | Sometimes | |
| YesProven, unproven, not checked | Rarely | Rarely | Rarely | |
| YesNo model needed | Rarely | Sometimes | Rarely | |
| YesMCP server, skill and guard | Varies | Varies | Usually | |
| YesNo add-ons to unlock | Varies | Varies | Varies | |
| YesBlind test apps, method public | Rarely | Rarely | Rarely |
Categories, not products. Tools within a category differ, and many teams run more than one. This is what each category typically covers; check any tool, including ours, against your own code.
03Honest about limits
What it misses, published next to what it finds.
The known limits, listed before you start.
The benchmark, including the misses- It misses real bugs.
- On 9 blind holdout applications it found 181 of 229 planted vulnerabilities and missed 48. It rated 32 of 90 Criticals as Critical, and flagged 39 of 152 known-safe controls. The misses are published with the hits. Measured with vulkro 0.30.0 on 2026-10-05; later releases have not been re-measured. How we measured.
- Java calls are followed by their declared type.
- A call into another file is followed when the declared type points to one implementation. A call it cannot pin down that way is not followed, and Kotlin is not read at all.
- PHP, C and C++ are read one function at a time.
- Input reaching a dangerous call inside the same function is proven; a value that leaves the function is not followed.
- It is not a penetration test.
- It reads code, metadata and settings and names the weak spot with its file and line. It does not attack a running application or org.