Why offline is the only acceptable default.

Three things happen when a security scanner takes your code into their cloud. First, you are trusting their network security, their employee access controls, and their incident response. Second, you are producing analysis reports that live on their disks indefinitely, which becomes a problem if your customers sue you and that data ends up in discovery. Third, you are feeding their training data, whether or not they are running an AI model today.

None of these are theoretical. The 2023 Codecov breach took CI secrets out of thousands of repositories because a build plugin shipped credentials to a vendor by default. The 2024 Snowflake breach showed that one compromised vendor credential unlocks every customer's data at once. Cloud security tools concentrate risk. They do not reduce it.

The argument for a cloud scanner is convenience. "We do the heavy lifting for you." The honest version is that the vendor needs your code on their servers to bill you for compute and to train next year's product. If the heavy lifting actually had to happen on a remote server, none of the offline scanners (Bearer, Semgrep CE, Brakeman, Bandit) would work.

Vulkro runs on a laptop. The 13-repo benchmark finishes in 104 seconds on a normal developer machine. There is no heavy lifting that requires a data centre.

What we don't collect, and how to verify it.

Vulkro collects nothing. No anonymised usage stats, no error reports, no installation pings, no "anonymous opt-in" anything. The only network call the binary ever makes is to check for a newer release once per machine per day, and that check is documented, opt-out via VULKRO_NO_UPDATE_CHECK=1, soft-fails after a 2-second timeout, and reads exactly one URL: the GitHub Releases atom feed for vulkro.

You don't have to trust this. The binary is statically linked. Run it under strace, dtrace, or your favourite sandbox. The only DNS lookup is api.github.com and only when the cache is older than 24 hours.

VULKRO_OFFLINE=1 removes even that call. With the variable set, vulkro refuses every outbound network operation and returns an error rather than silently fall back to anything.

$ VULKRO_OFFLINE=1 vulkro scan .
[ok] offline mode enforced
[ok] CVE bundle: ~/.vulkro/cve-bundle/ (signed, verified)
[ok] no outbound network calls permitted

Built and supported by humans.

The codebase is roughly 60,000 lines of Rust on tree-sitter. The CVE bundler is a separate Python pipeline. The detectors, the signing infrastructure, the docs, and the website are all maintained by the Vulkro team.

What that means in practice: when you email [email protected], a human reads it. Reply time is usually a day, sometimes faster. There is no Tier 1 routing through a partner support contractor. There is no chatbot. If an answer needs a deeper look, we will tell you, not stall you.

What we commit to.

• The benchmark stays public. Methodology, labelled examples, scoring code. Re-run any time. If our catch rate or false-positive rate gets worse between releases, file an issue and we will fix it or document why. The detectors themselves are closed (that is the product); the proof that they work is not.
• Breaking changes get a deprecation window. A CLI flag, a config key, or a JSON field doesn't disappear without a release of warnings.
• No telemetry, ever. This is the one commitment we will not negotiate. There is no "anonymous opt-in" path on the roadmap.
• No surprise charges. No auto-renewal, no auto-upgrade, no upsell modal. When your Pro license lapses the CLI prints a one-line note and drops to the Free tier; everything in Free keeps working. Pro features prompt for renewal, nothing hard-blocks. Buy a fresh one-time Pro license if and when you want it back.

And where we're going.

There is an enterprise path on the roadmap, with private rule packs, air-gapped license servers, on-premise CVE mirroring, and SSO. It is still a plan. The shape will be "a heavier license you renew yourself" not "a SaaS console", because nothing about the core product changes when a larger team buys it. If your team needs any of that today, email [email protected] and we'll figure out what works in the meantime. No upsell, no spam, just an honest conversation.

How to reach us.

Newsletter, for the weekly CVE + release digest: vulkro.substack.com
Substack Chat, for in-between threads and live questions: vulkro.substack.com/chat
Reddit, for public Q&A and scan-result discussion: reddit.com/r/vulkro
Bug reports, install help, "I think this finding is wrong": [email protected]
Sales, custom quotes, air-gapped deployments: [email protected]
License transfers, invoices, refund questions: [email protected]

No web form. No AI. No chatbot. Email and the chat threads are the API.