Skip to main content

Your first scan

This page shows you how to run a scan, read the results, and cut them down to what matters.

First, start the 14-day trial on the Billing page of the customer portal, app.vulkro.com/billing (vulkro buy opens it), then sign in once:

vulkro login

Without an active trial or Pro, scan commands refuse with exit code 1 and license_required (see Accounts and licensing).

Point Vulkro at any project:

cd path/to/your/project
vulkro scan .

The scan runs entirely on your machine. A mid-sized project takes about 30 to 90 seconds.

What happens during a scan​

Vulkro walks your project (respecting .gitignore), detects the language and framework, finds every HTTP route, and then checks for vulnerabilities, secrets, and known CVEs. It prints a summary when it is done.

JavaScript, TypeScript, Python, Go, and Java with Spring Boot support all get full analysis, included in every plan. PHP, C and C++ get single-function analysis. See Languages and coverage.

Read the output​

A run looks like this:

 Detected: TypeScript | Next.js (App Router)
 224 endpoints | 2,230 modules

CRITICAL  33   HIGH  355   MED  1369   LOW  1063

API1 BrokenObjectLevelAuth         115 findings
API8 SecurityMisconfiguration     2292 findings
SECRETS                            436 hardcoded | 19 in git history
DEPS                                23 CVEs (4 KEV-listed, 7 reachable)

Completed in 42s | exit 1 (Critical/High present)

Here is what each part means:

  • The severity counts are the headline. Critical and High stop a build by default.
  • The OWASP categories show where your risk is concentrated.
  • SECRETS covers both your current code and your git history.
  • DEPS flags the most dangerous CVEs first: KEV-listed means "known to be exploited in the wild," and reachable means the vulnerable code is actually called from your project.

See the details​

The default output is a summary. To see file names and line numbers:

vulkro scan . --verbose

For machine-readable output:

vulkro scan . --format json   | jq .findings[0]
vulkro scan . --format sarif  > vulkro.sarif

See Output formats for the full list (SARIF, SBOM, GDPR reports, CSV, PDF, and more).

Cut the noise​

By default Vulkro shows Medium and High findings. You can adjust that:

# Default: the day-to-day mode.
vulkro scan .

# Strictest and most precise. Best for a build that blocks merges.
vulkro scan . --min-confidence high

# Show everything, including low-confidence, pattern-only findings.
vulkro scan . --all-confidence

# Skip non-source files (Dockerfiles, lockfiles, .tf, templates).
vulkro scan . --scope src

Silence a specific finding​

Add a comment right in the code, no config file needed:

// vulkro:disable next-line API2
app.get("/internal/ping", noAuth);

// vulkro:disable-file at the top of a file silences all findings for that file. Every scan reports how many findings were suppressed, so nothing hides silently. See the suppressions guide.

Save the run​

vulkro scan . --save

Saving keeps the run in your local history so you can compare against a previous scan (vulkro diff <ref>), track trends over time, or use it as a baseline to gate pull requests.

What's next​

Last updated on