Question 1

What does Vlnry do?

Accepted Answer

Vlnry reads an authorized repository, tests an authorized target, and returns only vulnerabilities it reproduced with evidence and remediation.

Question 2

What does proof-by-exploitation mean?

Accepted Answer

A finding must have reproducible evidence from the isolated run. If the run cannot prove it, it is not presented as a validated vulnerability.

Question 3

Which model families can I use?

Accepted Answer

Claude, GPT, Gemini, DeepSeek, Kimi, and Z.ai / GLM are first-class families. Exact models remain unavailable until their required probes pass.

Question 4

Who pays for model usage?

Accepted Answer

You do, through your own provider or Vercel AI Gateway connection. Vlnry does not use a shared production inference key.

Question 5

What do recommended, beta, and unverified mean?

Accepted Answer

They describe compatibility evidence. Lifecycle is tracked separately as active, preview, deprecated, or retired. Only ready profiles can start a run.

Question 6

Does Vlnry need source access?

Accepted Answer

Yes. The selected GitHub repository is accessed read-only and attached to the immutable run snapshot.

Question 7

Can I test any target?

Accepted Answer

No. Every target requires ownership or explicit permission and a non-production consent gate before testing.

Question 8

Can I self-host Vlnry?

Accepted Answer

Yes. The Docker-first stack can run on your infrastructure. Deterministic fake mode works without a model key or live engine.

Question 9

Does the sample-report page scan my site?

Accepted Answer

No. It is static fixture content and accepts no URL, repository, email, target, or credential.

Frequently asked questions

Frequently asked questions