How Vulnara works

Vulnara scans your code for leaked secrets, personal data and vulnerable dependencies, and turns what it finds into a list you can work through and a score you can track. This page explains the handful of things Vulnara is built from, so the rest of the documentation makes sense.

What it is for

Everything in Vulnara sits in a simple hierarchy. Once you know it, you know where any screen, command or API call fits:

• Workspace: your team's space in Vulnara. It holds everything below.
• Git workspace: an organisation, group or user on your git provider that you connect.
• Repository: a repository imported from a git workspace.
• Scan: one scanner run on one repository, on a branch.
• Finding: one problem a scan reported.
• Security score: a number out of 100 that summarises the open findings.

How it works

Workspace

A workspace is the top level. Every repository, scan, finding, token and setting belongs to exactly one workspace, and nobody outside it can see them. You can belong to several workspaces and switch between them from the account menu. The account menu calls a workspace a team, for example Create New Team.

Each member holds a role in the workspace: VIEWER, EDITOR or ADMIN. A higher role includes everything the lower ones can do. See Teams and roles.

Git workspace

A git workspace is where your code lives: an organisation, group or user on GitHub, GitLab, Bitbucket, Azure DevOps or Codeberg / Forgejo. You connect it once, on the Workspaces screen in the sidebar. To reach private repositories, you add a git token to it. See Connect a git provider.

Repository

When you connect a git workspace, Vulnara imports its repositories with their branches and languages. A repository must be enabled to be scanned, and your plan sets how many can be enabled at once. See Repositories.

Scan

A scan runs one scanner on one repository. You start scans by choosing a category, and Vulnara queues one scan for every scanner that serves it, so one request can produce several scans. You can start scans by hand, on a schedule, or from CI. See Run a scan and Scan categories.

Finding

A finding is one thing a scan reported: a secret in a file, a piece of personal data, or a dependency with a known advisory. Every finding carries a category. Rules from different scanners that check the same thing are recognised as the same finding, so you work through each problem once. You record a decision on a finding, such as false positive or defer, and that decision survives rescans. See Triage findings.

Security score

Each repository has a security score out of 100, and the workspace has one too. It reflects the open findings from the latest scan of each repository. The dashboard shows it with its trend over the period you choose. See Security score.

Networks

Besides code, Vulnara can scan networks for exposed services. A network is a public address range you add to your workspace, and a network scan probes it. You can scan networks from the web app, the CLI and the API. See Network scanning.

Web applications

A web application is a public site or app you add to your workspace, and a web application scan tests it from the outside with safe checks. Web application scanning is enabled per workspace on request. See Scan a web application.

Ways in

You reach the same workspace, with the same permissions, in five ways:

• Web app: vulnara.rso.dev. Everything a person does day to day.
• CLI: the vulnara command for your terminal and scripts. See CLI.
• GitHub Action: theorigamicorporation/vulnara-action@v1 scans a branch in CI and can fail the build. See GitHub Action.
• GraphQL API: https://vulnara-gw.rso.dev/graphql, the API that the web app, the CLI and the action all use. See GraphQL API.
• MCP for AI clients: https://vulnara.rso.dev/mcp lets Claude or ChatGPT read your workspace, and make a few changes for members whose AI access is Write. See MCP.
• Chat in the web app: ask questions about your workspace without leaving the web app. See Chat in the web app.

Whichever way you use, Vulnara checks your role in the workspace on every request. An AI client or a script can never do more than the person or service account behind it.

Finding your way in the web app

• Sidebar: Dashboard and Vulnerabilities at the top, then Workspaces, Repositories, Web applications and Networks under Assets, Repository Scans and Network Scans under Scan History, Git Tokens and Service Accounts under Access & Security, and Settings at the bottom. New Scan opens the scan form from anywhere. On a narrow screen the sidebar collapses to icons.
• Command palette: press Ctrl + P to search your repositories and other resources, or Ctrl + O to jump to a screen or an action.
• Shareable lists: the page, sort, search and filters of a list are kept in the address bar. Send the link and a colleague in the same workspace sees the same view. Links never carry a scanner's name: a link from a scan to its findings names the scan itself.
• Theme and date format: choose Light, Dark or System, and a date and time format, in Settings. The choice follows you to other devices.

Good to know

• A button you are not allowed to use is shown disabled, with the role it needs, rather than hidden. That way you know the feature exists and who to ask.
• If the connection to Vulnara drops, an indicator tells you. Live updates, such as scan progress, come back when the connection returns.
• If a screen fails to load, you get an error panel with a way back to the dashboard and a reload button.
• Every finding carries a category, one of SAST, SCA, secrets or personal data, except some recorded before categories existed, which are shown as uncategorised. The category says what the finding is, not which scanner reported it. See Scan categories.

Next steps