vulkro-sf org connected-apps
Checks the live org's Connected Apps for risky OAuth settings, using recent token use to tell live apps from unused ones.
vulkro-sf org connected-apps --target-org <alias>
vulkro-sf org connected-apps -o <alias> --check-compromised --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-CONNECTED-APP-002 | High | The app has Full scope and an OAuth token used recently. |
SF-CONNECTED-APP-004 | Medium | A callback URL uses plain http://. |
SF-CONNECTED-APP-003 | Low | The app has stale OAuth tokens. |
Flags
| Flag | Meaning |
|---|---|
--target-org, -o <alias> | Org alias or username from sf org login. Required. |
--format <fmt> | Output format. Default table. |
--check-compromised | Also match each app's consumer key against a bundled list of OAuth client IDs exposed in public 2025 breaches. A match reports SF-CONNECTED-APP-COMPROMISE-001 (High). Same as VULKRO_SF_INTEL_COMPROMISED=1. |
The list ships inside the binary; nothing is looked up online. Air-gapped teams can point VULKRO_SF_INTEL_COMPROMISED_BUNDLE_OVERRIDE at a vetted bundle file. A match is worth investigating, not proof that the app is compromised in your org.
See also: Connected Apps, org packages.