- What's actually in the 14-day trial?
- Full Pro. Every detector, every output format, every language. No trial-only watermark, no truncated reports, no "preview" warnings on findings. The CLI tells you on day 12 that the trial is ending. On day 15 it drops to the Free tier and keeps scanning; Pro features prompt for purchase but nothing hard-blocks.
- What happens when my Pro license expires?
- Vulkro keeps working at the Free tier. Pro-only features prompt you to renew, but everything in Free (the core security scan, vulnerable-dependency check, secrets, broken-auth, injection, fast incident response, the MCP server and editor extension audits, CI integration) continues without interruption. The vulnerability database updates on the same schedule as Pro: we never punish you for not paying with a stale advisory feed. No auto-renewal, no surprise charges. Buy a fresh one-time Pro license whenever you are ready.
- What does “one machine, single developer” mean?
- Every Vulkro license is bound to one machine ID generated from your hardware. Run
vulkro machine-id to see yours. Need it on more than one machine, including CI? Email [email protected]. - Does Vulkro ever upload my source code?
- Never. Vulkro runs entirely on your own machine. No cloud upload, no telemetry, no AI service in the loop. See the privacy policy for the full statement, or read the manifesto for the reasoning.
- Is Vulkro open source?
- No. The detection code is closed source - that is the product. What we do publish is the benchmark itself: the test code, the labelled examples, and the scoring rules. You can run the benchmark on your laptop in five minutes and compare our catch rate and false-positive rate against the alternatives on the same examples. We compete on reproducible results, not on source openness.
- What's the line between Free and Pro?
- Free covers what a single developer on one project needs to ship safely: the OWASP API top 10, vulnerable-dependency check, secret detection, auth bugs, injection, fast incident response, the MCP server and editor extension audits, and CI-friendly output for GitHub Code Scanning. Free supports Python, JavaScript, TypeScript, and Go. Pro adds what teams and regulated industries pay for: audit-ready compliance reports (SOC 2, HIPAA, PCI, ISO 27001), a portfolio view across many projects, more languages (Ruby, Java, Kotlin, C#, PHP, and the full Salesforce stack), the deeper detection packs, audit-grade report formats (SBOM, executive PDF and HTML), and live API probing. Both tiers get the same vulnerability database updates on the same schedule.
- Do you offer refunds?
- No. Once a license file is issued it cannot be revoked, so refunds are not offered as a matter of policy. If you're unhappy, reach out and we'll do what we can. See the refund policy for the full text.