Skip to main content

vulkro-sf data-map

Map the org's data: every object and sensitive field, who reaches it and through which door.

Command reference​

Generated from vulkro-sf data-map --help (vulkro-sf 0.33.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Map the org's data: every object and sensitive field, who reaches it and through which door.

vulkro-sf data-map [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options​

FlagDescription
-f, --format <FORMAT>Output format: table or json. Default: table.
--focus <NODE_ID>Only the two-hop neighbourhood of one node, by id (e.g. --focus object:contact, --focus audience:guest)
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf data-map --help
Map the org's data: every object and sensitive field, who reaches it and through which door.

Scans the project and joins the object and field metadata (org-wide defaults, lookups and master-detail relationships, classifications and encryption), the guest sharing rules, the profile and permission set grants and the attack graph into one graph: stores, sensitive fields, policies, entry points (the attack graph's doors and the declared sites) and audiences (guest, external, internal, api-client). Every edge carries a proof grade (proven / resolved / metadata / detector) and the `file:line` fact behind it; degree and blast radius are computed per node. The same document is emitted by `vulkro-sf scan --format json` as `data_map` beside `attack_graph` and served by the console at `GET /api/sf/scans/:id/data-map`.

The map draws only what the metadata says: a standard object whose `.object` file is not in the project is drawn with `owd: unknown`, never assumed Private; record counts need a connected org; the `coverage` block lists every fact family the map does not collect, and the absence of an edge is never a protection claim.

Exit codes: `0` success (including a project with no object metadata, which prints an honest-empty map), `2` error (unscannable path, unknown `--format`, unknown `--focus` node). The map documents rather than gates, so exit `1` is not used.

Usage: vulkro-sf data-map [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
  -f, --format <FORMAT>
          Output format: table or json
          
          [default: table]

      --focus <NODE_ID>
          Only the two-hop neighbourhood of one node, by id (e.g. `--focus object:contact`, `--focus audience:guest`)

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on