vulkro-sf exposure

Report everything an unauthenticated (guest) visitor can reach, worst first, with proof.

Command reference

Generated from vulkro-sf exposure --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Report everything an unauthenticated (guest) visitor can reach, worst first, with proof.

vulkro-sf exposure [OPTIONS] [PATH]

Arguments

Argument	Description
[PATH]	Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options

Flag	Description
-f, --format <FORMAT>	Output format: table, json, markdown, or html. Default: table.
--free	Summary edition: counts, verdicts and setting states only. Drops every file path, line, class, method, field name, message and proof step, so the report can be shared outside the team.
-t, --target-org <ALIAS>	Salesforce org alias or username to add live facts from, read-only through your own sf CLI login (capability sf-live-org): each site's status and guest user, and the record counts behind every guest-readable object (SELECT COUNT() only)
-v, --verbose...	Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quiet	Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-color	Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --help	Print help (see a summary with '-h')

Full vulkro-sf exposure --help

Report everything an unauthenticated (guest) visitor can reach, worst first, with proof.

Report the UNAUTHENTICATED (guest) attack surface: every finding a guest / unauthenticated Experience Cloud visitor can reach, ranked most-severe first, each with its mechanism, location, human detail (which renders the object / field / granting profile), and its dataflow proof chain. Fuses the guest-exposure axis, the Apex / LWR mechanism, and the proof that a normal scan already computes into one report - the single clearest view of what an unauthenticated visitor can reach and why.

Guest exposure depends on live Experience Cloud metadata (a guest profile grant plus a published site); a project without it reports a clean guest surface (exit 0), which is the expected result, not a miss.

The report is organised PER SITE (Experience Cloud and Force.com): the objects and fields the guest profile can read (with guest sharing rules, the external org-wide default and the personal data in reach), the Apex the guest can call and the sharing mode it runs in, the Flows the guest can run, the site and org settings that widen guest reach, the top proven paths, one verdict per site (exposed, at risk, limited, no guest access, not determined) and the fixes as Setup paths and metadata changes. Vulkro never applies a fix. Authenticated external members are reported as a second audience. `--format html` writes a self-contained page; `--free` writes the summary edition (counts and verdicts only, no code, file, field or record detail). `--target-org` adds live facts (site status, guest user, `SELECT COUNT()` record counts; no record is read) and is refused under --offline / VULKRO_OFFLINE.

Exit codes: 0 = no guest exposure; 1 = guest exposure present (a guest-reachable finding, or a site whose verdict is exposed or at risk); 2 = error (unscannable path, unknown --format, unreachable org tooling).

Usage: vulkro-sf exposure [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
  -f, --format <FORMAT>
          Output format: table, json, markdown, or html
          
          [default: table]

      --free
          Summary edition: counts, verdicts and setting states only. Drops every file path, line, class, method, field name, message and proof step, so the report can be shared outside the team

  -t, --target-org <ALIAS>
          Salesforce org alias or username to add live facts from, read-only through your own `sf` CLI login (capability `sf-live-org`): each site's status and guest user, and the record counts behind every guest-readable object (`SELECT COUNT()` only)

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')