Connect Salesforce orgs
The Salesforce app in Vulkro Cloud scans your orgs: posture, users and
access, integrations, exposure, personal data and Apex code, with the same
engine as vulkro-sf.
Connect an org
- Go to Orgs > Connect Org.
- In Salesforce, create an External Client App you own, following the checklist on that page (it shows the callback address). We recommend a dedicated Integration User with a "Vulkro read" permission set, the app approved for that permission set only, and IP restrictions on.
- Paste back the login host (production or sandbox), the consumer key and a name for the org.
- Sign in to Salesforce to approve.
Production orgs and sandboxes connect the same way; the login host decides which it is. How many you can connect depends on your plan.
Read-only, always
Vulkro Cloud reads configuration and metadata, code, users and permissions,
login history and IP addresses (for threat detection) and record counts. It
never reads the contents of your business records and never deploys or
changes anything. The OAuth scopes are api and refresh_token; the
permission set below narrows what they can do.
| Permission | Why |
|---|---|
| API Enabled | Every read uses the Salesforce APIs. |
| View Setup and Configuration | Settings, metadata, sharing, Connected Apps, Setup Audit Trail. |
| View All Users | Users, profiles, permission sets and assignments. |
| View Health Check | The Health Check score. |
| View Event Log Files | Threat detection. Skip it to turn threat detection off. |
| Modify Metadata Through Metadata API Functions | Salesforce requires it for any Metadata API retrieve, including the read-only retrieve of your code. Skip it if the code comes from Git (Org Settings > Code Source). |
| Manage Users (optional) | Salesforce requires it to read login history. Without it those checks show as not checked. |
Session token (Advanced): for a sandbox or developer org you can paste a session token for a quick look. It acts with all of that person's permissions and cannot be refreshed, so schedules stop when it expires. Never use it for production.
Scans
Click Scan on the org, or set a schedule per org: every 6 hours, daily, weekly or monthly (the shortest interval depends on your plan). A scan usually takes 10 to 20 minutes. Org Settings > Code Source can read the code from a Git repository instead of the org.
What you get
- One issue list per org, kept across scans, covering posture, identity, integrations, personal data, code, anti-patterns, tests and coverage, and release readiness. See Issues and triage.
- Rules and suppressions: every rule, including ones that have not fired; make a rule advisory or turn it off for all orgs or some files.
- Custom rules on users, permission sets, integrations, Health Check settings or Apex, tested on the latest scan before they go live.
- Changes between scans, threat detection, access reviews, compliance and AgentExchange readiness.
From the terminal: Connect the CLI.