Package 01
Starter
10,000 monthly credits for individual projects (10,000 files + 10 live sites).
- 10,000 monthly credits
- 10,000 files + 10 live sites / month
- Up to 5,000 files in a single scan
- 1 user · shared Web + MCP credits
VulKill /SaaS plans
Make room for security.
Plan it to suit you.
Authorized security scanning from VulKill servers.
Choose the package that suits your needs.
Billed monthly. Each Enterprise bundle includes 5 seats; your total depends on the number of bundles selected.
Package 02
Pro
30,000 monthly credits for professional work (30,000 files + 25 live sites).
- 30,000 monthly credits
- 30,000 files + 25 live sites / month
- 5,000 files/container parallel scanning
- 1 user · shared Web + MCP credits
Package 03
Max
100,000 monthly credits for advanced projects (100,000 files + 60 live sites).
- 100,000 monthly credits
- 100,000 files + 60 live sites / month
- Automatic parallel shredding (Auto-Shard)
- 1 user Web + MCP + Desktop
team pack
Enterprise
5 seats and 350,000 monthly credits per Enterprise bundle (350,000 files + 200 live sites).
- 350,000 monthly credits per bundle
- 350,000 files + 200 live sites / month
- 5 concurrent users per bundle
- As the quantity increases, people and credit multiply.
$200/month
monthly payment
10% discount on annual payment
1 bundle · 5 seats · 350,000 credits (350,000 files + 200 sites)
$180/month
$2.400 $2,160 / year
10% off · save $240 per year
1 bundle · 5 seats · 350,000 credits (350,000 files + 200 sites)
01 / Approach
Understanding a system.
Looking at every layer.
VulKill moves security review to different layers of the application. The scope of the review, findings and technical evidence are evaluated together.
Discover full coverage ↓
01
Web & API
Authentication, access controls, input security, and the application's connections to the outside world.
02
mobile applications
Application behavior, data storage, networking, and security limits specific to mobile platforms.
03
Code & infrastructure
Source code, dependencies, configurations, and systems on which the application runs.
VulKill / Private edition
Broad scope.
In-depth review.
VulKill special version; It combines web, API, mobile application, source code and infrastructure review into a common security process. Provides the full review scope of v1.1 with advanced analysis, verification and evidence management capabilities.
It correlates every step from source code to runtime evidence, from discovery to post-fix check. Collects analysis results under common root causes; It tracks the scope of investigation, level of evidence, and business status together.
19review category
161control head
24tool and examination method
The basic scope consists of 158 control and also confirmed 3 controlled verification. The following special edition capabilities build on this foundation.
Analysis
Links beyond code.
Cross-language bridges, trust boundaries, dependency accessibility, and similar code paths are evaluated in a single review.
Verification
From claim to traceable evidence.
The source, runtime, and published package are associated with each other. The results before and after correction are recorded with separate evidence.
Management
The status of each job is visible.
A persistent work queue, scope ledger, and institutional access and retention controls support the operational integrity of the review.
Abilities of the special edition
Analysis, coordination and verification capabilities complement the existing review scope.
01Advanced analysis and cross-language bridgesExamining the root cause, trust bound, and linked code in different languages together.
- Semantic root cause grouping: associates findings with structural features such as source, sensitive processing point, trust boundary, and the way data is moved.
- Polyglot and native hyperlink analysis: Examines relationships extending from Python and JavaScript/TypeScript inputs to Rust and C/C++ frontiers. Evaluates data width, null, ownership, time-to-live and panic/exception contracts in PyO3, N-API, JNI, Cython and C ABI migrations.
- Multi-layer request difference analysis: shows static contract differences between how the proxy/edge, middleware, cache key, and application interpret the same request.
- Sibling patch variant investigation: collects locations where the security fix may have been incompletely applied to similar edges or code paths as investigation candidates under the same root cause.
- Transaction representation–signing consistency: the transaction summary displayed to the user compares entity and entity values to the content actually signed.
- Secret and key pair analysis: reduces unnecessary alerts by parsing default keystore and key pair patterns.
02Data flow, accessibility and level of evidenceMaking visible under what conditions a finding is effective and to what extent it is confirmed.
- Typed attack chains: track identity, tenant, state, transport, time, and evidence summary conditions as separate links; It does not establish relationships based on similar words alone.
- Protocol and runtime hook accessibility: enriches dependency warnings with whether the relevant code path is accessible in the project.
- Levels of evidence: static candidate separates runtime validation and product-level retesting; links the escalation to a record of verifiable evidence.
- Engine and file coverage visibility: records analysis errors, missing coverage, and skipped operations; It does not present an incomplete review as a clean result.
03Scope ledger and local dynamic validationTracking every scanned file, scheduling missing jobs, and collecting controlled runtime evidence.
- Machine-verifiable scope ledger: records discovered, crawled, skipped, timed out, and failed files along with engine version and rule suite summary.
- Missing resume plan: produces a repeatable resume plan for missed, failed, or timed out targets by separating completed files.
- Local ASan verification: with human approval, dynamically examines the selected C resource within the permitted root, file size, duration and memory limits; If the required engine or isolation is not ready, verification is not considered done.
- Stateful protocol agreement: the behavior of two peers verifies restarts and state summaries within defined local test boundaries.
- C/C++ scan integrity: combines source and engine summaries and per-file scanned, skipped, or failed results into an aggregated validation record.
04Persistent job queue and operational visibilityCoordinating the jobs of multiple runners and maintaining job state after restart.
- Persistent job queue: Control of repetitive transactions, limited retries, post-restart recovery, and persistent result reading with SQLite WAL or optional PostgreSQL.
- Job ownership and time renewal: the runner prevents the same job from being completed twice with the time ownership key and generation number; It prevents the old executor whose job is taken over from writing results.
- Analysis–runner integration: connects server and job queue to the same product flow; It uses the PostgreSQL backend with explicit selection and secure configuration.
- Operations view: consolidates scope, evidence, work queue, retention, and report preparation statuses into a common summary that does not reveal sensitive paths and identities.
05Pre-post-fix verification and packet bindingCorrelating the finding to the source code, runtime, and released software package.
- Negative control, RED and GREEN separation: maintains separate summaries for the outputs of the control condition, the vulnerable behavior and the corrected behavior.
- Source–runtime–package link: links the evidence record to the source tree, commit, executed command, runtime, and output summaries.
- Published package verification: compares ZIP, JAR, Wheel, npm and TAR packages to the source manifest without extracting them to the file system; Checks summary for path traversal, symbolic link, special file type, duplicate or undeclared member, size and integrity.
- Retest after change: tracks with scope ledger and evidence records that the new result belongs to the same family of findings and packages.
06Evidence management, AI triage and report preparationMaking integrity of findings, preparation for disclosure, and retention decisions auditable.
- Hash-chain proof ledger: maintains records in an ordered chain of integrity; authenticates with the local root of trust or external signing boundary as needed.
- Evidence-aware AI triage: evaluates the local model or external agent's suggestion along with cryptographic evidence verification; AI recommendation alone does not produce confirmed finding status.
- Release readiness controls: monitor conditions such as severity assessment, proof of correction, product-level retesting, and package binding; In missing conditions, it does not show the finding ready for submission.
- Standard disclosure package: prepares a machine-readable record and human-reviewable disclosure supplement for findings whose verification conditions have been completed.
- Retention and legal hold: protects selected audit, job, notification and backup records against the retention schedule; If the protection record cannot be trusted, it stops the deletion process.
07Corporate identity, double approval and signingControlled access for users, roles, projects and high-impact processes.
- Offline OIDC verification: implements signature, issuer, audience, time, nonce and subject checks via local JWKS with digest pinned.
- Browser OIDC flow: timed and disposable state/nonce, PKCE-S256 and secure session binding controls.
- Enterprise user lifecycle: SCIM-like management flow combining tenant/project membership, role mapping, iterative transaction control and deactivation; Storing the hash of the bearer value instead of itself.
- Two administrator approvals: in high-impact identity and storage transactions, a timed and transaction-context-dependent approval from an active administrator other than the one who created the request.
- Secure configuration files: normal files accessed only by the owner, symlink denial, non-link-following read, and integrity digest check of the executable.
- External signer limit: verifying the private key in a provider-independent KMS/HSM-like signing flow without importing it into the VulKill process.
08Deployment, installation and update integrityChecking the integrity of the software from the build output to the installed files.
- Protected deployment profile: protects runtime, static assets, and documentation while separating development and test evidence from the deployment package.
- Signed package lifecycle: connects package manifest, installation and usage authorization, update, rollback, backup, and installed file integrity; It refuses to install and start on missing or modified mounts.
- Repeatable Linux ARM64 native compilation: compilation pipeline that compares two independent outputs offline with a digested toolchain and checks its own integrity.
- Platform verification flows: Checks macOS code signature and Apple notarization verification and Windows Authenticode results through the operating system's verification tools and full package digest.
All titles of the reviewOpen the category and examine the control titles. Targeted testing is performed within the agreed reach and scope.
01Data collectionIn-scope assets, entry points, application flows, and unintentionally exposed technical information.8 control
- External information leak
- Server fingerprint
- Web metafiles
- Application and subdomain inventory
- Page content leak
- entry points
- Application execution paths
- architectural mapping
02Configuration and deploymentDeployment settings, management surfaces, HTTP methods, security headers and environment separation.9 control
- Infrastructure configuration
- Platform configuration
- Sensitive file extensions
- Old and unreferenced files
- Management interfaces
- HTTP methods
- Security headers
- Subdomain takeover risk
- Cloud storage visibility
03identity managementManagement of registration, invitation, account lifecycle and user identity.5 control
- Role descriptions
- Registration process
- Account lifecycle
- Account numbering
- Predictable identities
04authenticationLogin, password policy, multi-step verification and account recovery flows.13 control
- Moving encrypted credentials
- Default credentials
- Brute force protection
- Authentication bypass
- Remember me function
- Browser cache
- Password policy
- Password reset
- Multi-factor authentication
- Alternative channels
- OAuth and OpenID Connect
- Passwordless login and magic connection
- MFA fatigue and recovery
06Session managementCookies, session durations, logout, token renewal and session integrity.8 control
- Session token scheme
- Cookie attributes
- Session pinning
- Client side session leak
- CSRF protection
- Exit and cancellation
- Session timeout
- concurrent sessions
07Input validationForm, API, query, file, URL and output processing limits.15 control
- Mirrored script injection
- Persistent script injection
- HTTP method change
- Parameter pollution
- Database injection
- XML and XPath processing
- Server side code/command processing
- Server side requests
- Host title
- File upload
- Bulk field assignment
- Secure forwarding
- Header and log injection
- NoSQL and search query injection
- LDAP and expression language injection
08Server side interactionsThe server's request, file, template, command, XML and cache processing limits.10 control
- Server side request forgery
- Local and remote file inclusion
- Directory migration
- Server side template injection
- Operating system command injection
- Unsafe object serialization
- XML external entity processing
- HTTP request smuggling
- Web cache poisoning
- file processing line
09Error handlingError messages do not leak information, safe error behavior and traceability.3 control
- Error messages
- Error behavior
- Logging and alarm
10Weak cryptographyTLS, sensitive data transport, password storage, signature, key and secret lifecycle.7 control
- TLS configuration
- Sensitive data migration
- Application cryptography
- secret management
- password storage
- Token and signature verification
- Key lifecycle
11Data protection and privacyData minimization, access, export, backup, retention and deletion flows.9 control
- Data classification
- Data minimization
- Excessive data in response
- Export security
- Backup and snapshot protection
- Search and cache leak
- Store and delete
- Data transfer to third party
- Client package secrets
12business logicTransaction order, duplications, price and quantity integrity, concurrency and abuse limits.8 control
- Business rule integrity
- Request repeat limits
- Workflow skip
- Price and quantity integrity
- Race conditions
- File and resource limits
- Feature abuse
- Transaction rollback
13client sideBrowser, client storage, scripts, redirects, and UI security.9 control
- DOM based script injection
- JavaScript execution surfaces
- HTML injection
- Client-side redirection
- CSS and resource loading
- Browser storage
- web messaging
- click evasion
- Third party dependencies
14API securityREST, GraphQL, WebSocket and webhook streams; schema, identity and data access limits.13 control
- API inventory and versions
- API authentication
- API object authorization
- API schema validation
- API resource limits
- GraphQL security
- WebSocket security
- Webhook security
- Data and feature overexposure
- API inventory management
- Trust third-party API responses
- JWT and access tokens
- API error and pagination behavior
15Infrastructure and domain nameConfiguration with DNS and domain name, service inventory, cloud and infrastructure access.9 control
- DNS record integrity
- Subdomain takeover
- Source server hiding
- Management and diagnostic surfaces
- Cloud storage permissions
- Cloud metadata access
- Email domain protection
- Certificate and domain lifecycle
- Network and service exposure
16supply chainDependencies, lock files, SBOM, build, deployment and supply chain controls.8 control
- addiction inventory
- Known vulnerabilities and usage analysis
- Package integrity
- Third-party script integrity
- Compilation and release pipeline
- SBOM and proof of origin
- Third party service risk
- Source and artifact secrets
17Resource and durabilityResource quotas, timeout, queuing, and durability assessment in a controlled testing environment.8 control
- Rate and quota limits
- Request size and time limit
- Compression and archive bombs
- Expensive queries and filters
- Tail and back pressure
- cache crash
- dependency interrupt
- Capacity and recovery
18Registration and incident responseRecording, masking, integrity, alarm and response processes of security events.8 control
- Security incident coverage
- Sensitive data masking
- Record integrity
- Correlation and time
- Alarm quality
- Storage and access
- incident response preparation
- Detection verification
19Custom approved verificationsThree additional headers requiring separate written consent, synthetic account or non-production environment, and masked evidence.3 check special approval
- Controlled account lockout verification
- Staging capacity test observation
- Masked data leak evidence
From code to cloud, areas of expertiseWe consider the source code, configuration and technical proofs of the application together.
01Source code and data flow
- We examine input to sensitive processing points such as SQL, command, template, HTML, file path, routing, SSRF, and serialization.
02Secret and identity information security
- We evaluate key, password, and token signals in code, configuration, and permissioned Git history in a masked form.
03Privacy and data flow
- We examine the processing limits of personal data in logs, telemetry, third-party services and artificial intelligence connections.
04Identity protocols
- We evaluate the signature, duration, routing and trust limits of JWT, OAuth and similar identity flows at the code/configuration level.
05Database and access rules
- Schema, query, RLS and privilege settings; We examine it in terms of data access and safe migration.
06Business logic and transaction integrity
- We consider business rules such as state transitions, price and quantity, recurring transactions, stock and balance.
07Server and host hardening
- We review the provided system settings for access, SSH, network, service, log, and basic security policies.
08Zero-trust and service communication
- We evaluate mTLS, service mesh, network policies, and inter-service authorization configurations.
09Cloud IAM and Kubernetes
- We review role and policy permissions, storage access, encryption, security groups, and Kubernetes RBAC settings.
10Protocol security
- We evaluate the trust bounds in the application's protocol and connection configurations with relevant inspection profiles.
11Cryptography inventory
- The use of algorithms, keys and cryptographic components; We examine CBOM and post-quantum transition together with the configuration signals.
12Browser add-ons and PWA
- We evaluate manifest, permission, content policy, messaging, service worker and client storage configurations.
13Desktop application security
- We examine protocol, inter-process communication, and trust boundary configurations in desktop applications.
14iOS and Android security
- We cover manifest, packet, permission, data storage, network, embedded secret and broadcast configurations along with mobile code review.
15AI, agent and RAG security
- We evaluate prompt injection, output processing, tool authorizations, human approval, access filters and consumption limits at the code and architecture level.
16Supply chain and CI/CD
- We examine dependencies, lock files, SBOM, container/IaC, build and deployment integrity signals.
17Web3, IoT and firmware
- We evaluate the resource and configuration inputs provided in such projects with the relevant security profiles.
18DNS and email security
- We examine the security logs on domain and email configurations and the technical evidence presented.
19Resource consumption and ReDoS
- Examines resource limits, regular expressions, timeout and unlimited transaction signals in the code; We evaluate capacity reports within the scope of the test environment.
20Audit log and event visibility
- We evaluate traceability of security events, masking, log integrity, and alarm evidence.
Every layer of the mobile applicationReviewing Android, iOS, Flutter and React Native projects with source code, packages, configuration and runtime evidence.
01Data retention and privacy
- Fine-grained data limits on device storage, backup, logs, clipboard and screenshot.
02Cryptography and secrets
- Embedded keys, randomness, use of encryption, and management of secrets.
03Identity and authorization
- Server-side authentication for session, biometrics, OAuth, and critical transactions.
04Network and TLS
- HTTP/TLS, ATS, Network Security Config, certificate validation and related pinning configurations.
05Platform integrations
- Deep link, WebView, exposed components, IPC and notification security.
06Code, permissions and SDKs
- App permissions, third-party SDKs, dependencies and secure publishing settings.
07Application integrity
- Debug and signature configurations; Protection signals regarding device and application integrity.
08Privacy notices
- Privacy Manifest, tracking limits and related mobile data/device communication configurations.
Right question, right methodLocal analysis, validated screening profiles, external tool reports and expert review come together in the same evaluation. The usage of each method is stated below.
01VulKill basic scanExamination method and scope of use
- We examine HTTPS/TLS, security headers, cookies, CORS/CSP, and security signals on the response in a low-impact manner.
02VulKill code and data flow analysisExamination method and scope of use
- In Python and JavaScript/TypeScript code, we trace across functions and files how external input reaches precise processing points.
03VulKill built-in controllersExamination method and scope of use
- We evaluate codes and configurations under identity, data, cloud, mobile, cryptography and other specialized topics.
04OWASP ZAPExamination method and scope of use
- We perform scoped web/API review and recorded report evaluation on authorized targets.
05Burp Suite reportsExamination method and scope of use
- We examine recorded sitemap and HTTP transaction evidence and correlate it with expert findings.
06Semgrep / OpengrepExamination method and scope of use
- We examine local source code in terms of security rules and data flow, and evaluate recorded analysis reports.
07joernExamination method and scope of use
- We perform deep code and data flow analysis with supported profiles in C/C++, Java/Kotlin, PHP, Go, Ruby and C# projects.
08GitHub CodeQL reportsExamination method and scope of use
- We evaluate SARIF results from external CodeQL analysis and map them to relevant audit titles.
09TriviaExamination method and scope of use
- We examine supported dependencies, container images and IaC files for vulnerabilities, secrets and misconfigurations.
10OSV-ScannerExamination method and scope of use
- We compare supported local lock files with the open database and evaluate recorded dependency reports.
11SchemathesisExamination method and scope of use
- We evaluate approved native API and schema profiles and limited API controls along with recorded test reports.
12testssl.sh / SSLyze reportsExamination method and scope of use
- We evaluate VulKill's native TLS profiles and recorded detailed TLS reports.
13NmapExamination method and scope of use
- We review the TCP service inventory and limited service/release information within the authorized scope.
14nucleiExamination method and scope of use
- We evaluate authorized HTTP targets with the selected template scope and subject the results to independent verification.
15gitleaksExamination method and scope of use
- We evaluate secret signals in allowed local project files and Git history with masked results.
16TruffleHogExamination method and scope of use
- We examine credential signals from local file and Git history profiles without revealing values.
17npm auditExamination method and scope of use
- We consider local lock files with separate approvals for project input and npm advisory service access.
18Dependabot reportsExamination method and scope of use
- We review logged dependency alerts, affected components, and remediation priorities.
19SSL Labs reportsExamination method and scope of use
- We evaluate recorded TLS and certificate reports and incorporate the findings into the security review.
20OpenSSLExamination method and scope of use
- We evaluate X.509 reports recorded with native TLS certificate validation.
21Playwright/browser test reportsExamination method and scope of use
- We consider recorded results of external browser tests along with role, session, and user flow analysis.
22Grafana k6 reportsExamination method and scope of use
- In the capacity reports received from the approved test environment, we evaluate the number of requests, delay and threshold results in the report.
23SIEM and log reviewExamination method and scope of use
- We evaluate recorded security incident evidence together with expert review of log and alarm processes.
24Expert manual reviewExamination method and scope of use
- We verify business rules, access limits, and the actual impact of findings through expert evaluation.
Usage and report optionsCommand line, native web interface, MCP, optional AI triage, and development team friendly outputs.
01CLI, native web interface and MCPv1.1 tabanından gelen kullanım yolları.
- Security inspection via command line, local web interface and local stdio MCP.
- Merging SAST, SCA, SBOM, VEX, IaC and registered vehicle reports into a common evaluation flow.
- Human-approved action plans, project scope, quality checks and audit trail.
02Optional local model and external AI agentAI-powered assessment with recommendation, consent and limits of evidence.
- Project-based permissions and schema-compliant recommendation flow for the external AI agent.
- Triage with optional, OpenAI-compatible native model connectivity; The recommendations of the local model are evaluated together with human judgment and audit trail.
- Linking the level of evidence of recommendations to verifiable log and integrity checks in the custom version.
03Report and development workflow outputsDifferent output formats for technical team and decision makers.
- JSON, HTML, SARIF, GitLab and PDF reporting options.
- Technical report, executive summary, priority remediation plan and record of retest status.
- Linking recorded external analysis results with review titles and technical evidence.
Finding, solution and revalidation.
We turn the output of the review into a concrete fix plan that the development team can work on.
Proven findings
CWE/CVSS information on affected entity, masked technical evidence, verification status, business impact, and appropriate findings.
Priority solution plan
Correlation of findings due to the same root cause, evaluation of false positives, technical report and executive summary.
Post-correction check
Retesting of approved fixes, comparison of previous and current results, recording of closure status.
Inspections are conducted only within the authorized scope. The environment, limits and approval of active verification and capacity tests are determined before the study.
Let's talk about the scope of the project ↗
02 / Research
behind the find
There is a research.
Published reviews, technical notes, and open source works. Discover from the source how results are achieved.
Read the research ↗VulKill / Research archiveOpen source. Traceable work.
03 / Let's examine it together
The next step is
take a closer look.
VulKill
Security research, application review
and open source development.