# VulKill Security (vulkill.com & app.vulkill.com)

> AI-native autonomous security testing, deep source-code & data-flow verification, mobile & desktop binary security, cloud/IaC auditing, and live web/API pentesting — connected directly to ChatGPT, Claude, Cursor, VS Code, Gemini CLI, and CI/CD via Model Context Protocol (MCP) and REST API.

VulKill Security combines a 4-stage autonomous AI pentest loop (`Map → Attack & Prove → Patch → Retest`), Z3 symbolic path verification, cross-language Code Property Graph (CPG / AST) taint analysis, Code-First DSPM (KVKK/GDPR privacy flow auditing), AI/MCP agent security (`AI-BOM`), Web3 & wallet blind-signing verification, supply-chain SBOM/license/malware analysis, and verified live DAST into a single workspace with a strict zero persistent source-code retention guarantee.

## Canonical URLs & Entry Points

- Product & Capabilities Overview: https://vulkill.com/
- English Homepage: https://vulkill.com/en/
- SaaS Workspace & Dashboard: https://app.vulkill.com/
- Public Workspace Overview: https://app.vulkill.com/en/about
- MCP Setup Guide (ChatGPT, Claude, Cursor, VS Code, Gemini CLI): https://vulkill.com/mcp-guide
- Pricing & Credit Plans: https://vulkill.com/pricing
- Privacy Policy (GDPR, KVKK & Zero Source-Code Retention): https://vulkill.com/privacy
- Terms of Service & Commercial EULA: https://vulkill.com/terms
- Refund & Cancellation Policy (Paddle Merchant of Record): https://vulkill.com/refund-policy
- Remote MCP Server Endpoint (Streamable HTTP / JSON-RPC 2.0): https://app.vulkill.com/api/mcp
- OpenAPI 3.1 Specification: https://app.vulkill.com/openapi.json
- OAuth 2.0 Protected Resource Metadata: https://app.vulkill.com/.well-known/oauth-protected-resource
- OAuth 2.0 Authorization Server Metadata: https://app.vulkill.com/.well-known/oauth-authorization-server
- Sample Report 1 (AI, LLM & MCP Capabilities Pentest PDF): https://vulkill.com/samples/vulkill-sample-ai-mcp-pentest-report.pdf
- Sample Report 2 (Web, API & External Network Pentest PDF): https://vulkill.com/samples/vulkill-sample-web-network-pentest-report.pdf
- Sample Report 3 (Mobile Android/iOS & Desktop Electron/Tauri Pentest PDF): https://vulkill.com/samples/vulkill-sample-mobile-desktop-pentest-report.pdf

## Core Architecture: 4-Stage Autonomous AI Pentest Loop

1. **Stage 1 — Map (Mimari ve Saldırı Yüzeyi Haritalama)**: Automatically discovers application routes, API schemas (REST, GraphQL, WebSocket, gRPC, webhooks), authentication/session flows, trust boundaries, cloud/IaC resources, and AI/MCP tool surfaces.
2. **Stage 2 — Attack & Prove (3 Katmanlı Kanıt ve Sembolik Doğrulama)**: Validates candidate vulnerabilities using 3-layer evidence (`Layer 1: Reachability & Data Flow`, `Layer 2: Exploit Proof / Z3 Symbolic Feasibility`, `Layer 3: Real-World Business Impact`) to eliminate false positives and dead-code noise.
3. **Stage 3 — Patch (Kopyala-Yapıştır Üretim Yaması)**: Generates context-aware, copy-paste-ready remediation diffs tailored to the exact file, line, framework, and language.
4. **Stage 4 — Retest (RED → GREEN Regresyon Doğrulaması)**: Re-runs the exact verification vector after remediation and records a cryptographic/auditable scope ledger proving transition from vulnerable (`RED`) to remediated (`GREEN`).

## Specialized Security Capabilities (260+ Controls Across 12 Domains)

- **Z3 Symbolic Execution & Cross-Language CPG/AST Taint Analysis**: Tracks untrusted input to sensitive sinks (SQLi, Command Injection, SSTI, SSRF, Path Traversal, Deserialization, XXE, Prototype Pollution, ReDoS) across Python, JavaScript/TypeScript, Go, Rust, Java/Kotlin, C/C++, C#, PHP, Ruby, Swift, and Solidity — including FFI, JNI, Node native addons, WebAssembly, and IPC bridges.
- **Code-First DSPM (KVKK & GDPR Privacy Flow Audit)**: Identifies PII, financial, health, and credential data flows directly from source code and schemas without connecting to live production databases. Detects unmasked logging, analytics/SDK leakage, and unauthorized PII transmission to external LLM APIs.
- **Vibe Coding & PR Diff Security Audit**: Fast incremental security review for AI-generated code (ChatGPT, Claude Code, Cursor, Copilot, Windsurf) and pull request diffs — catching broken object-level authorization (IDOR/BOLA), missing tenant isolation, race conditions, insecure defaults, and hallucinated packages (`slopsquatting`).
- **AI Agent, LLM, RAG & MCP Server Pentesting + Shadow AI Inventory (AI-BOM)**: Automatically inventories all AI SDKs, models, vector databases, and MCP servers in the codebase (`AI-BOM`). Audits direct/indirect prompt injection, RAG poisoning, MCP tool over-privilege (`Excessive Agency`), missing human-in-the-loop approval, and insecure LLM output handling.
- **Web3, Smart Contract & Wallet Blind Signing Security**: Audits Solidity/EVM and Solana contracts (reentrancy, access control, oracle manipulation, delegatecall/proxy risks) alongside EIP-712 structured signing payloads, wallet blind-signing deception, and external KMS/HSM signer isolation.
- **Supply Chain, Reachable SCA, SBOM (CycloneDX / SPDX), License Risk & Malware Detection**: Combines reachability analysis (whether a vulnerable dependency function is actually called) with open-source license compliance (`GPL`, `AGPL`, `SSPL` copyleft detection), End-of-Life (`EOL`) runtime detection, and malicious package / install-hook (`preinstall`/`postinstall`) inspection.
- **Mobile (Android APK/AAB, iOS IPA, Flutter, React Native) & Desktop (Electron, Tauri) Hardening**: Covers MASVS/MASTG mobile controls (manifest, deep links, WebView, certificate pinning, Keystore/Keychain, Privacy Manifest) and desktop/binary hardening (`nodeIntegration`, `contextIsolation`, custom protocol handlers, ELF/PE/Mach-O PIE, RELRO, Stack Canary, NX).
- **Cloud IAM, Kubernetes, Container & Infrastructure-as-Code (IaC)**: Audits Dockerfile, Kubernetes manifests, Helm, Terraform, CloudFormation, cloud storage permissions, metadata SSRF (`169.254.169.254`), and DNS/TLS/email security (`SPF`, `DKIM`, `DMARC`, subdomain takeover).

## 5 Scan Modes (`mode`)

- `auto`: Automatically selects applicable checks based on supplied `sourceFiles` and/or verified HTTPS `targetUrl` (up to 5,000 files per shard with automatic parallel sharding).
- `source`: Fast static source, secret, dependency, and configuration audit (`SAST + Secrets + SCA`).
- `semantic`: Deep cross-file AST/CPG taint analysis, Z3 symbolic path verification, business logic, and cross-language bridge auditing.
- `infrastructure`: Container, Kubernetes, Terraform/IaC, CI/CD pipeline, SBOM, license, and supply-chain integrity audit.
- `web`: Low-impact live DAST and API security verification against ownership-verified HTTPS targets (`targetUrl`).

## Compliance Frameworks & 5 Multi-Audience Report Formats

- **Compliance Mapping**: Findings map to `ISO/IEC 27001:2022` (A.8.8, A.8.25, A.8.28), `SOC 2 Type II` (CC6.1, CC6.6, CC7.1, CC8.1), `PCI-DSS v4.0` (Req 6.2, 6.3, 6.4), `GDPR` (Art. 25, 32) & `KVKK` (Art. 12), `EU DORA`, `NIS2`, and `OWASP Top 10` (Web, API, Mobile MASVS, LLM).
- **5 Report Formats**:
  1. Full Technical Auditor Report (`JSON` / `SARIF 2.1.0` / `Markdown` with 3-layer proof and copy-paste patches)
  2. Executive & Board Risk Summary (`Markdown` / `HTML`)
  3. Customer & Vendor Trust Summary (shareable external attestation without exposing proprietary source code)
  4. Post-Patch Retest Verification Report (`RED → GREEN` regression proof)
  5. Auditable Scope & Coverage Ledger (`coverage.checks` showing completed, skipped, and incomplete modules)

## Zero Source-Code Retention & Privacy Architecture

- **0-Day Source Code Retention**: Submitted `sourceFiles[].content` payloads are encrypted in transit (`TLS 1.3` + `AES-256-GCM` job-bound key), processed solely inside a single-job isolated ephemeral container on AWS ECS Fargate (`eu-central-1`, Frankfurt), and permanently wiped in a `finally` block upon job completion (`ephemeralWorkspaceCleaned: true`).
- **Zero AI Model Training**: Customer source code, configurations, target URLs, and scan reports are never used to train or fine-tune any AI or LLM model.
- **Read-Only by Design**: VulKill never mutates customer repositories or production infrastructure; it returns verified findings and proposed diffs for developer review.

## SaaS Pricing & Credit Model (USD)

- **Free AI / IDE Trial Allowance**: 500 file credits + 1 live site scan / month on https://app.vulkill.com
- **Starter**: $10 / month ($108 / year with 10% annual discount) — 10,000 file credits + 10 live sites / month (1 user, MCP + API + Web)
- **Pro**: $20 / month ($216 / year) — 30,000 file credits + 25 live sites / month (1 user, MCP + API + Web)
- **Max**: $59 / month ($637.20 / year) — 100,000 file credits + 60 live sites / month (1 user, MCP + API + Web)
- **Enterprise (Kurumsal)**: $200 / month ($2,160 / year) per 5-seat bundle — 350,000 file credits + 200 live sites / month (scales linearly with bundle quantity)
- **AI & IDE Top-Up Pack**: $5 one-time add-on — 2,500 file credits + 5 live sites

## Active MCP Tools (`https://app.vulkill.com/api/mcp`)

- `vulkill_check_credits`, `vulkill_wallet_status`, `vulkill_credit_usage`, `vulkill_estimate_scan`
- `vulkill_ai_guide`, `vulkill_capabilities`, `search`, `fetch`
- `vulkill_start_scan`, `vulkill_auto_scan`, `vulkill_get_scan_status`, `vulkill_list_reports`