vulkro-sf env
The environment variables vulkro-sf reads, by topic (also vulkro-sf help env)
Command reference
Generated from vulkro-sf env --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.
Print the environment variables vulkro-sf reads, by topic.
vulkro-sf env [OPTIONS] [TOPIC]
Arguments
| Argument | Description |
|---|---|
[TOPIC] | A topic name (listed below) or all (the default) |
Options
| Flag | Description |
|---|---|
-f, --format <FORMAT> | text (default) or markdown, the form the README and the docs site embed. Default: text. Possible values: text, markdown. |
-v, --verbose... | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins) |
-q, --quiet | Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged. |
--no-color | Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb. |
-h, --help | Print help (see a summary with '-h') |
Full vulkro-sf env --help
Print the environment variables vulkro-sf reads, by topic.
Topics: scan (detector switches and the org context), notify (scan --post-to credentials), engine (Apex taint and detector thresholds), tools (the platform's own Apex analyzer, ESLint and RetireJS paths), rules (custom rules and the marketplace), intel (threat-intel bundles), events (Event Monitoring thresholds), quality (quality --gate), console (vulkro-sf serve), editor (the language server and MCP), workflow (hooks, review, attest and the antipatterns cache), gates (legacy detector gates), rules-bundle (the Agentforce knowledge bundle), licence (login and CI), cloud (the workspace connection). With no topic every topic is printed.
Exit codes: 0 = printed; 2 = unknown topic.
Usage: vulkro-sf env [OPTIONS] [TOPIC]
Arguments:
[TOPIC]
A topic name (listed below) or `all` (the default)
Options:
-f, --format <FORMAT>
`text` (default) or `markdown`, the form the README and the docs site embed
[default: text]
[possible values: text, markdown]
-v, --verbose...
Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)
-q, --quiet
Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged
--no-color
Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb
-h, --help
Print help (see a summary with '-h')
Scan: detector switches and project context
===========================================
VULKRO_SCA_DEV_DEP_DEMOTE
Development-only npm dependencies (build, test
and lint tooling that is never deployed to the
org) are held back: their CVEs are left out of
the table, JSON and SARIF, and the table says
how many. ON by default; `0` / `false` / `no` /
`off` lists them at full confidence, and
`--min-confidence low` lists them as the
Low-confidence rows they are. A package any
lockfile installs for production is never held
back.
VULKRO_APEX_ASYNC_TAINT
Which Apex constructors become call-graph nodes,
so a tainted value handed to `new SomeJob(x)` and
enqueued reaches the sink in that class's
`execute()`. ON by default (since 2026-09-22) in
the narrow mode: unset or any value other than
the two below = only classes implementing
Queueable / Database.Batchable / Schedulable.
`0` / `false` / `no` / `off` = OFF (the previous
behaviour); `all` = every constructor (the wide
arm). Turned on after an A/B on the labelled
corpus moved zero findings (recall 42/42, no
false-positive file added); the mechanism is
verified end-to-end on
`bench/fixtures/apex_async_ctor_taint`.
VULKRO_APEX_RECEIVER_RESOLVE
Binds each Apex call to the methods the
project's declared types can reach (enclosing
class chain, typed receivers, `new T()`, return
types, interface / virtual subtypes) instead of
every same-named method. Ambiguous calls still
carry taint but are reported as unproven. ON by
default; `0` / `false` / `no` / `off` restores
name-only resolution.
VULKRO_APEX_EFFECTIVE_MODE
Judges Apex record-access findings (CRUD/FLS,
IDOR, sharing bypass, agent FLS) by the sharing
context and access mode each data operation
actually runs in: the class keyword inherited
down the call stack and the `extends` chain, the
API 67.0 user-mode default, and `as system` /
`WITH SYSTEM_MODE` per operation. A batch or
`@future` body is its own entry point unless a
request value is passed into it. ON by default;
`0` / `false` / `no` / `off` restores the
previous per-class verdicts.
VULKRO_SF_OAUTH_TAKEOVER_ANY_BROAD
Set to 1 to let ANY broad OAuth scope (including
a bare `api`) qualify a ConnectedApp for the
High org-takeover composite
(SF-OAUTH-SCOPE-007). By default only a `full`
scope does: `api` is still bounded by the
authorising user's own permissions, so it is
reported as over-broad (Medium) instead.
VULKRO_SF_GATE_BASE Default base ref. Overridden by `--gate-vs`.
Lets a CI lane set the comparison once
(`VULKRO_SF_GATE_BASE=origin/main`). Setting it
turns on the diff-scoped gate, which is Pro.
VULKRO_GIT_HOOK Exported by the pre-commit hook `vulkro-sf init`
writes, to mark a run started by a git hook (see
above). Not something you set yourself.
VULKRO_SF_ORG_CONTEXT
Path to a Salesforce org-context file
(`vulkro.sf-org-context/v1`: active holders per
profile / permission set, object access,
feature licences, component origin). Overrides
`<project>/.vulkro/org-context.json`. With it,
grants nobody holds are reported as latent (Low),
paid add-on advice (Shield, Field Audit Trail)
only fires when licensed, and Salesforce-shipped
components are Info. Without it, findings that
need an org fact are tagged org-unverified. A
malformed file is reported once and ignored.
VULKRO_SF_HYGIENE Set to 1 to opt in to the metadata-hygiene
detectors: duplicate custom labels, duplicate
/ case-colliding custom fields, and
candidate-unused permission sets. These are
informational code-quality findings (Severity
Low), off by default so a standard scan stays
focused on security. The unused-permset check
is a CANDIDATE only: static source cannot see
direct user / profile assignments, so verify
live-org assignments before deleting a
flagged permission set.
VULKRO_SF_GOVERNANCE_FILE
Path to the metadata-governance config (owner /
deprecated / review-by conventions). Absolute, or
relative to the project root. Defaults to
`.vulkro-sf/metadata-governance.yaml`. When the
config is present the deterministic governance
pass runs (SF-META-GOV-001 missing owner,
SF-META-GOV-002 overdue review, SF-META-GOV-003
deprecated-but-referenced); when it is absent the
pass is a no-op.
Notifications: scan --post-to
=============================
`--post-to` integrations (Slack / Teams / Jira / PagerDuty)
each read secrets from environment variables so credentials never
land on the shell history. Set the variables before running the
command (or before the CI job starts). Notification failures are
non-fatal: the scan still exits 1 on findings and a warning is
printed to stderr.
VULKRO_SF_SLACK_WEBHOOK Slack incoming-webhook URL. A URL passed
inline as `--post-to slack=<url>` wins
over it.
VULKRO_SF_TEAMS_WEBHOOK MS Teams Adaptive Card webhook URL. A URL
passed inline as `--post-to teams=<url>`
wins over it.
VULKRO_SF_JIRA_BASE_URL Jira Cloud base, e.g.
`https://acme.atlassian.net`.
VULKRO_SF_JIRA_EMAIL Atlassian account email for basic auth.
VULKRO_SF_JIRA_TOKEN Atlassian API token for basic auth.
VULKRO_SF_PD_ROUTING_KEY PagerDuty Events API v2 routing key.
Every value falls back to the console's saved notification settings
(~/.vulkro/sf-notify.json, Settings > Notifications in `vulkro-sf serve`)
when neither the flag nor the variable gives it; `--post-to saved` posts to
every saved target.
VULKRO_SF_NOTIFY_RETRIES Notification dispatch retry budget
(default 3, clamped to [1, 5]).
Backoff `[250ms, 1s, 4s, 10s, 20s]`
between attempts; 1 disables retry.
VULKRO_SF_DEBUG Any value, even an empty one, keeps full
webhook URLs in `--post-to` error
messages instead of redacting them, to
debug a mistyped Slack / Teams URL. Leave
it unset in shared CI logs.
Apex taint engine and detector thresholds
=========================================
VULKRO_APEX_BRACE_WALK
ON by default (set to 0 to opt out). The Apex local-taint walk
descends into for / if / while / try bodies and binds for-each loop
variables (including over Trigger.new / Trigger.old), so a dynamic
SOQL or DML sink fed inside a loop or guard block is traced.
VULKRO_TAINT_LOCAL_ALIAS
ON by default (set to 0 to opt out). A plain local copy of a tainted
parameter (`String q = p; helper(q);`) carries the taint across the
call, on resolved calls only.
VULKRO_APEX_TAINT_DEPTH
Interprocedural Apex taint call depth. Default 5, clamped to
[1, 12]. Raise it (for example 8) for deep Controller / Service /
Selector stacks; the scan's coverage note says when a flow hit the
limit.
VULKRO_APEX_STORED_TAINT
Set to 1 to opt in to coarse second-order (stored) Apex taint: a
High stored SOQL injection when a guest-reachable write stores input
on a field and a later dynamic query selects that field. Off by
default (high false-positive risk).
VULKRO_SF_GUEST_EXPLOIT
Set to 1 to add the fused SF-GUEST-EXPLOITABLE finding to `scan`: a
guest-reachable Apex entry point joined with a proven dataflow or
CRUD/FLS finding on the same class. With `--org`, the org's live
guest grants and record counts are used. Off by default.
VULKRO_SF_API_VERSION_FLOOR
Integer API version below which a `*-meta.xml` component is flagged
end-of-life (SF-THREAT-API-EOL-001: High when retired, below 21;
Medium when deprecated). Default 31; a non-numeric value falls back
to the default.
VULKRO_SF_FLS_USER_BROAD_BAR
Per-user field-level-security audit (needs User and
PermissionSetAssignment exports under the scan path): a sensitive
field readable (SF-FLS-USER-001) or editable (SF-FLS-USER-002) by
more than this many users is flagged. Default 5; a malformed or
non-positive value falls back to the default.
VULKRO_SF_RECERT_STALE_DAYS
`vulkro-sf recert`: days without a login after which an active user
is flagged as a dormant live credential. Default 90; a malformed or
non-positive value falls back to the default.
External tools: the platform's own Apex analyzer, ESLint and RetireJS
=====================================================================
VULKRO_PMD_BIN
Absolute path to the `pmd` binary for `scan --include-pmd`. Wins over
the first `pmd` on PATH; a set path that is not a file is an error.
An empty value searches PATH.
VULKRO_ESLINT_BIN
Path to the `eslint` binary for `scan --include-eslint`, used as
given. Unset or empty: `eslint` on PATH, then `npx eslint`.
VULKRO_RETIREJS_BIN
Full path to a `retire` binary for `scan --include-retirejs`. A set
path that does not exist is an error. Unset or empty: `retire` on
PATH, then `npx retire`.
Custom rules and the rule marketplace
=====================================
VULKRO_SF_CUSTOM_RULES_DIR
When set, the custom-rule loader reads ONLY this directory and skips
both `.vulkro-sf/rules/` (project) and `~/.vulkro/rules/` (user).
Useful in CI to test a rule pack in isolation.
VULKRO_SF_MARKETPLACE_BUNDLE_OVERRIDE
When set, `rules marketplace` reads ONLY this gzipped JSON bundle
instead of the built-in one. For testing a bundle in CI or
sideloading on an air-gapped host.
VULKRO_SF_MARKETPLACE_INSTALL_DIR
When set, `rules marketplace install` / `uninstall` use this
directory instead of `~/.vulkro/rules/`.
VULKRO_RULES_DIR
The per-user rule directory the console's Rules tab lists and
installs marketplace rules into, instead of `~/.vulkro/rules/`.
Threat-intel bundles: sca, org audits, trust status
===================================================
VULKRO_SF_INTEL_BUNDLE_OVERRIDE
Path to your own gzipped JSON managed-package advisory bundle for
`vulkro-sf sca`. None ships, so without it SF-SCA-001 (vulnerable
package) and SF-SCA-002 (end-of-life package) are reported as not
checked.
VULKRO_SF_INTEL_TRUST_BUNDLE_OVERRIDE
Path to your own trust.salesforce.com incident snapshot, for `org
trust-status` (gzipped JSON) and the console's Trust Status tab
(plain JSON). None ships: without it the command exits 2 and the tab
says no intel is loaded; neither reports the org as clear.
VULKRO_SF_APT_PLAYBOOKS
Any value other than empty or 0 is the same as `org audit-trail
--check-apt-playbooks`: the SetupAuditTrail and AuthSession timeline
is also matched against the APT playbooks.
VULKRO_SF_INTEL_APT_BUNDLE_OVERRIDE
Path to a local gzipped JSON APT playbook bundle to use instead of
the cached or built-in one (an air-gapped sideload).
VULKRO_SF_INTEL_COMPROMISED
Any value other than empty or 0 is the same as `org connected-apps
--check-compromised`. No compromised client-ID list ships and that
command does not read consumer keys, so it only prints that the
check did not run.
VULKRO_SF_INTEL_COMPROMISED_BUNDLE_OVERRIDE
Path to your own gzipped JSON list of compromised OAuth client IDs,
which the console (`vulkro-sf serve`) matches Connected Apps
against. None ships.
Event Monitoring: org event-monitoring and logs analyze
=======================================================
The lookback window of the live-org audit, then the thresholds of the
behavioural rules `vulkro-sf logs analyze` runs. Each falls back to its
default when unset or unparseable.
VULKRO_SF_EVENT_MON_SINCE_DAYS
Lookback window in days for `org event-monitoring` (default 7).
`--since-days` wins over it.
VULKRO_SF_EVENT_MON_ANOMALY_ZSCORE
Z-score outlier bar for SF-EVENT-MON-ANOMALY-001 (default 3.0). A
non-positive value is ignored.
VULKRO_SF_EVENT_MON_ANOMALY_PEER_RATIO
Peer-median ratio bar for the same rule (default 10.0): the
outlier's volume must be at least this many times the peer median.
A value below 1.0 is ignored.
VULKRO_SF_EVENT_MON_REPORT_RUN_COUNT
SF-EVENT-MON-010: a user running more than this many Report /
Dashboard / ReportExport events in the window is flagged (default
50). A non-positive value is ignored.
VULKRO_SF_EVENT_MON_REPORT_EXPORT_ROWS
SF-EVENT-MON-010: a user exporting more than this many report rows
in total is flagged (default 100000). A non-positive value is
ignored.
VULKRO_SF_EVENT_MON_IMPOSSIBLE_TRAVEL_MINUTES
SF-EVENT-MON-011: two successful logins from different IPs inside
this many minutes are flagged (default 15). A non-positive value is
ignored.
VULKRO_SF_EVENT_MON_DEVICE_FP_WINDOW_MINUTES
SF-SESSION-FP-001: window in minutes that groups one user's
successful logins (default 60). A non-positive value is ignored.
VULKRO_SF_EVENT_MON_DEVICE_FP_COUNT
SF-SESSION-FP-001: more than this many distinct browser and platform
fingerprints for one user inside the window is flagged (default 3).
A non-positive value is ignored.
VULKRO_SF_EVENT_MON_ADV_EXFIL_RATIO
SF-EVENT-MON-013: a query whose SOQL complexity score is at least
this many times the user's own baseline median is flagged (default
8.0). A value below 1.0 is ignored.
VULKRO_SF_EVENT_MON_GRANT_VELOCITY_COUNT
SF-EVENT-MON-015: more than this many dangerous grants by one actor
inside the velocity window is a burst (default 3). A non-positive
value is ignored.
VULKRO_SF_EVENT_MON_GRANT_VELOCITY_MINUTES
SF-EVENT-MON-015: the velocity window in minutes (default 30). A
non-positive value is ignored.
VULKRO_SF_EVENT_MON_API_ABUSE_SCORE
SF-EVENT-MON-017: a user whose blended request-rate, session and
token-reuse score crosses this bar is flagged (default 1000). A
non-positive value is ignored.
Quality gate: vulkro-sf quality --gate
======================================
Each overrides the matching key in `.vulkro-sf/quality-gates.yaml`;
an unparseable value is ignored.
VULKRO_SF_QUALITY_GATE_MAX_COMPLEXITY
Fail if any Apex method's cyclomatic complexity exceeds this
integer.
VULKRO_SF_QUALITY_GATE_MIN_COVERAGE
Fail if overall test coverage is below this percent (0 to 100,
decimals allowed).
VULKRO_SF_QUALITY_GATE_MAX_FINDINGS
Fail if the total finding count exceeds this integer.
VULKRO_SF_QUALITY_GATE_MIN_GOVERNANCE
Fail if the governance score (0 to 100) is below this integer.
VULKRO_SF_QUALITY_GATE_MAX_CLASS_LINES
Fail if any Apex class has more source lines than this integer.
VULKRO_SF_QUALITY_GATE_MAX_METHODS
Fail if any Apex class declares more methods than this integer.
Console: vulkro-sf serve
========================
The console requires an access token, like `vulkro serve`: each start
mints a random one and prints the console URL with it. A request without
the token gets HTTP 401; one from another web page gets HTTP 403.
VULKRO_SERVE_TOKEN
The access token to require instead of a generated one (shared
with `vulkro serve`). It is not printed; scripts send it as
`Authorization: Bearer <token>`. Required for any non-loopback
bind.
VULKRO_SERVE_ALLOWED_HOSTS
Comma-separated hosts whose `Origin` the console also accepts, for
a console behind a reverse proxy that rewrites `Host` (shared with
`vulkro serve`).
VULKRO_SF_BIND
Bind address. Default 127.0.0.1. A non-loopback address such as
0.0.0.0 is refused unless VULKRO_SERVE_TOKEN is set.
VULKRO_SF_PORT
Listen port. `--port` wins over it; unset or unparseable lets the
OS pick a free port, which the console prints.
VULKRO_SF_DATA_DIR
Data directory (the console's SQLite store and on-disk state, and
the `quality-history.jsonl` that `quality` appends to and `trends`
reads). Default `~/.vulkro-sf/data/`, else `./.vulkro-sf/data/`.
VULKRO_SF_ENGAGEMENTS_DIR
Root of the consultancy engagement folders the console's engagement
dashboard reads, instead of `~/.vulkro/engagements/`.
Language server and MCP
=======================
VULKRO_SF_LSP_LOG
Any value other than empty or 0 writes per-message trace lines from
`vulkro-sf lsp` to stderr.
VULKRO_SF_LSP_TARGET_ORG
Default target org (alias) for the `vulkro-sf.scan-org` command
when the editor does not pass `initializationOptions.targetOrg`.
VULKRO_SF_LSP_DEBOUNCE_MS
`textDocument/didChange` debounce window in milliseconds. Default
300, clamped to [50, 5000]; an unparseable value falls back to 300.
VULKRO_SF_MCP_LOG
Any value other than empty or 0 writes per-request trace lines from
`vulkro-sf mcp serve` to stderr. Off by default so the stdio
JSON-RPC stream stays clean.
Hooks, review, attest and the antipatterns cache
================================================
VULKRO_SF_SKIP_PRECOMMIT
Set to exactly 1 to bypass the pre-commit hook `vulkro-sf init
--pre-commit` writes, for one commit.
VULKRO_REVIEW_CONTEXT
Default number of diff context lines `vulkro-sf review` shows
around each change (default 3). `--context` wins over it.
VULKRO_SF_ATTESTER
Identity `compliance attest` records when `--submitter` is not
given. Falls back to `unknown`.
VULKRO_SF_NO_CACHE
Any value, even an empty one, bypasses the per-file detector cache
of `vulkro-sf antipatterns` (same as `--no-cache`).
VULKRO_SF_CACHE_DIR
Directory for that cache (`sf-antipattern-cache.json`) instead of
`~/.vulkro/` (same as `--cache-dir`).
Detector legacy gates
=====================
Detector legacy gates (one-release fallbacks after cross-method
taint-engine migrations; default OFF):
VULKRO_SF_AP018_LEGACY re-enable the legacy intra-file AP-018.
VULKRO_SF_AP024_LEGACY re-enable the legacy intra-file AP-024
(partial-success DML without SaveResult
inspection).
VULKRO_SF_AP042_LEGACY re-enable the legacy intra-file AP-042
(HTTP callout without retry path).
VULKRO_SF_AP044_LEGACY re-enable the legacy intra-file AP-044
(REST endpoint without auth check).
VULKRO_SF_AP060_LEGACY suppress AP-060 entirely (Type.forName
dynamic dispatch with no FLS / sharing
marker anywhere in the workspace).
AP-060 ships fresh so this env var
only silences emission.
The Agentforce knowledge bundle
===============================
Agentforce knowledge-bundle distribution (AP-066..AP-070). A scan
never downloads the bundle: it uses the verified copy that
`vulkro-sf update` last fetched, else the built-in seed.
VULKRO_SF_OFFLINE set to 1 to ignore the cached
bundle (scans use only the
built-in seed) and to make
`vulkro-sf update` skip the
bundle refresh.
VULKRO_SF_RULES_BUNDLE_URL override the base URL that
`vulkro-sf update` fetches from.
Default
`https://dist.vulkro.com/sf/rules`.
VULKRO_SF_RULES_BUNDLE_OVERRIDE sideload a local JSON bundle
(testing / pre-publish).
VULKRO_SF_RULES_BUNDLE_CACHE_DIR override the on-disk cache
(default `~/.vulkro/rules-bundle/`).
VULKRO_SF_RULES_BUNDLE_MIN_REFRESH_SECS
age in seconds after which a
scan prints a one-line note
suggesting `vulkro-sf update`
(default 86400, clamped
[60, 604800]).
Licence: vulkro-sf login, CI
============================
Every scanning command needs a licence (start the 14-day trial at
app.vulkro.com/billing, then `vulkro-sf login`). For CI and air-gapped runners:
VULKRO_ACCOUNT_TOKEN a CI key from app.vulkro.com (Settings). Every
scanning command signs in with it automatically when
no licence is cached on the machine, so CI needs no
`vulkro-sf login` step.
VULKRO_LICENSE_B64 the base64 of a `.lic` file (`base64 < key.lic`,
`base64 -w0` on Linux), for air-gapped CI: verified
in memory on every scanning command when no licence
is installed; nothing is written to ~/.vulkro.
VULKRO_ACCOUNT_URL the account / API base `login` talks to (default
https://app.vulkro.com/api).
Vulkro Cloud: vulkro-sf cloud
=============================
`vulkro-sf cloud` and the `sf_cloud_*` MCP tools use the connection
`vulkro-sf cloud connect` saved (~/.vulkro/sf-cloud.json). Pro Cloud
(`vulkro-sf cloud connect --pro`) stores no token: each request carries this
machine's Vulkro sign-in, or VULKRO_ACCOUNT_TOKEN when it is set. For CI
against a company workspace:
VULKRO_SF_CLOUD_URL workspace address to use instead of the saved
connection. Needs VULKRO_SF_CLOUD_TOKEN, unless it
matches the saved workspace.
VULKRO_SF_CLOUD_TOKEN a workspace token (vkws_...) to use instead of the
saved one. Needs VULKRO_SF_CLOUD_URL when this
machine has no saved connection.
VULKRO_OFFLINE set to refuse every network call; every `cloud`
command is then refused (local scans keep working).
Any value turns it on, including an empty one,
except 0, false, no and off (any case).
VULKRO_SF_OFFLINE the same rule; skips only the Agentforce rules
bundle refresh.