VulKill Security

VulKill inspects source codebases and verified live websites across 12 comprehensive security domains (260+ security controls): (1) Auth, Session & Access Control (IDOR/BOLA/BFLA/JWT/OAuth2/Multi-Tenant), (2) Business Logic, Payment/Wallet & Race Conditions (Double-Spend/TOCTOU), (3) Code Injection & RCE (SQLi, NoSQLi, Command Injection, XSS, SSTI, XXE), (4) Network, SSRF & File System (CSRF, CORS, Path Traversal, ZipSlip), (5) Leaked Secrets, API Keys & Git History, (6) Supply Chain, SCA/CVE & SBOM, (7) AI, LLM & MCP Agent Security (Prompt Injection, Tool Abuse), (8) Web3, Smart Contracts, Wallet Blind Signing & Cryptography, (9) Containers, Kubernetes, Cloud & IaC, (10) Mobile (APK/IPA) & Desktop (Electron/Tauri), (11) Deep AST Taint Tracking, Z3 Symbolic Proof & Binary Hardening, and (12) Live Website Security Testing + 3-Layer Real-World Impact Triage (False-Positive Elimination, Exploitability Proof & Copy-Paste Remediation Patch).

Connect your own VulKill account, review the requested permissions, and inspect your credits before scanning. New members can complete membership and grant MCP access on one consent screen after signing in. Scan coverage depends on the supplied files, verified target, and selected mode; the completed report identifies the checks actually performed. Source-code scans require file contents, not a local path or repository URL alone. Live website scans require verified ownership and explicit authorization. Read-only planning and report tools do not start scans or spend credits.