Skip to main content

Usage guide

This is the full flow to get started with Vulinder. Follow sign up -> log in -> register your first service and scan, in order, and you will reach your first security analysis results. Use the table of contents on the right to jump to any step.

Sign up​

Anyone can sign up for Vulinder right away (no approval code needed). You can sign up directly with email or with a Google · GitHub account.

Sign up with email​

  1. On the [Sign up] screen, enter your name, email, and password.
  2. A verification email is sent to the address you entered. Enter the 8-digit code from the email to confirm ownership and complete sign-up.
  3. Once verified, you are taken to the [Log in] screen. Log in with the account you just created.
Log in / sign up screenLog in / sign up screen
Email verification only once

Email is the single identity key for your account. Once verified, you are not asked to verify again on later logins. If the verification email does not arrive, check your spam folder or request a resend.

Sign up with a social account (Google · GitHub)​

Press a social button on the login / sign-up screen to authenticate with Google or GitHub and come straight in.

  • Social accounts already have a verified email, so no separate email verification is needed.
  • If the email matches, it is automatically linked to your email sign-up account. It is the same account no matter how you enter.

Your organization is created automatically​

Vulinder manages all data at the organization level. When you finish signing up (email verification or social sign-up), an organization is created for you automatically, and you become its administrator. There is no separate screen to create an organization. You can invite teammates later. (Members and Roles)

If your team already uses Vulinder

Instead of creating a new organization, you can join by invitation. Enter the invite token you received from an administrator on the sign-up screen, and you join that organization as a member instead of creating a new one.

Log in​

Once you have signed up, log in with your email and password or with a social account.

Log in with email​

Enter the email and password you used to sign up. Email verification is required only once, so you are not asked to verify again on later logins.

If you have not verified your email yet

Login is blocked for an unverified email, and a resend verification email prompt appears. Confirm your email with the code in the message, then log in again.

Social login (Google · GitHub)​

Press the social button on the login screen to authenticate with Google or GitHub and come straight in. If the email matches, it is automatically linked to your email sign-up account, so it is the same account no matter how you enter.

After logging in​

  • When you log in, you land on the organization [Dashboard]. If you have no services registered yet, the Register a service wizard below opens automatically.
  • Change your name, theme (light / dark), language, and password in Account settings.

Register a service​

The flow from registering your first service after logging in to seeing your first security analysis results. This uses a source code (Git) service as an example, but the flow is the same for other types.

  • Time required : About 10 minutes (excluding scan time)
  • What you need : A logged-in account, the repository URL to analyze, and a read-only token
  • Outcome : Your first list of vulnerabilities organized by severity, plus the organization dashboard

The service registration wizard​

On your first login you have no services registered, so the service registration wizard opens automatically. (To add more services later, start it again anytime from Register service on the [Services] page.) The wizard has four steps.

  1. Choose a type : Pick the target to register: source code, container image, web service, server / host, or SBOM upload.
  2. Name and analyses : Name the service and choose which analyses to run. For source code, choose among SAST, SCA, Secret, IaC, and SBOM.
  3. Source and access : Enter the details needed to reach the target. For source code, that is the repository URL and an access token (or a file upload). (For details, see Source code)
  4. Confirm : Review the settings and finish registering.
Register service: select the analysis targetRegister service: select the analysis target
Use least-privilege tokens

For private repositories, a token with read-only (read repository) permission is enough. Saved tokens are stored encrypted and shown masked on screen.

Run your first scan​

Registration alone does not start a scan. When you finish registering, you land on the [Services] list, so open the service you just created and press Run Analysis at the top of each analysis tab to start the first scan. From then on, you can automate runs with a scan schedule or CI integration.

  • Scans run asynchronously, and you receive a notification when they finish. They keep running even if you close the window.
  • The progress status changes from Running to Completed.

Review results and take action​

When a scan finishes, the vulnerabilities found are organized by severity.

  1. Use the Dashboard to see your organization's overall risk at a glance.
  2. In Triage, review individual items and mark them as false positive if they are not a real risk, or as accepted risk if you are not addressing them now.
  3. Handling high-severity CRITICAL and HIGH items and KEV (actively exploited) items first is the basic order of remediation.
  4. Export results as PDF / VEX with Reports.
Triage inboxTriage inbox