Lonkero — Rust web vulnerability scanner (v3.7, AI agent mode)

What it is

Lonkero is a proprietary (not open-source) Rust web scanner from Bountyy Oy, Finland. This matters up front because the catalog summary calls it "open-source": the page states plainly, "This software is proprietary. Commercial use requires a valid license," and the build requirements list a "Valid license key (for premium features)." cargo install lonkero and the source clone work, but the flagship techniques the summary sells are license-gated premium modules.

What's actually behind the license

The advanced detection the summary highlights is not in the free tier. The page's "premium features" list includes exactly the modules the summary names:

• sqli_blind_advanced — binary-search blind SQLi (5–7 requests vs 100+)
• xss_proof_based — the mathematical proof-based XSS (16 contexts, no browser)
• ssrf_cloud_metadata, ssrf_protocol_smuggling (gopher://, dict://, file://)
• file_upload_polyglot, business_logic_advanced, graphql_batching_attacks

CI/CD examples pass a LONKERO_LICENSE_KEY secret, confirming scans need it in practice.

Operational details the summary omits

Version numbers on the page are inconsistent — it advertises v3.7 (AI agent) but also v3.0 "Intelligent Mode," v3.2 OOBZero confirmation, and a --payload-intensity flag tagged "v3.9." Treat the "v3.7" label loosely.

Concrete invocations worth knowing:

lonkero scan https://example.com --payload-intensity maximum   # all 12,450+ XSS payloads
lonkero scan https://example.com --multi-role \
  --auth-username user@example.com --auth-password userpass \
  --admin-username admin@example.com --admin-password adminpass
lonkero ai https://example.com --provider ollama --model llama3.1:70b
lonkero ml sync        # fetch server-trained detection model
lonkero scan ... --no-ml   # skip model scoring entirely

The AI agent needs ANTHROPIC_API_KEY (BYO keys); auth cookies/tokens are passed through to every scan it fires.

Caveats — vendor claims to verify independently

• "5% false positives vs industry 20–30%" and "300x faster" XSS are marketing figures with no methodology given.
• The OOBZero "zero-infrastructure" pitch is undercut by the premium list, where genuine out-of-band modules (oob_detection, oob_dns_exfiltration, oob_http_callbacks) are all marked "Coming Soon." OOBZero is statistical inference plus Pearson-timing confirmation, not a callback replacement you can buy today.
• The ML "one-way, GDPR-needs-no-consent" model downloads weights from lonkero.bountyy.fi and requires a valid license; the privacy claim (no data uploaded) is the vendor's own assertion, not independently shown.
• --no-rate-limit and the multilingual/dorking recon features make this an active, intrusive scanner — authorized targets only.

Bottom line for the deciding engineer: the techniques are real and specific, but the ones that make this interesting are proprietary and license-keyed, and the headline metrics are unverified. Budget for a license and validate the false-positive claim on your own targets before relying on it in CI.