`vulkro-sf org governance`

Governance checks: is a backup configured (never "no backup" without evidence), the Einstein Trust Layer settings (data masking, audit trail, toxicity; zero retention is not readable), agent-to-owner attribution and each agent's running user, report and dashboard folders open to portal and community users, dashboards that run as a user with org-wide data access, CRM Analytics apps shared with all portal or partner users, what each installed package can reach (its permission sets, object access, connected apps and API-only holders), and secret rotation age (named and external credentials and auth providers unchanged for a year, certificates expiring within 30 days or expired).

Command reference

Generated from vulkro-sf org governance --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

vulkro-sf org governance [OPTIONS] --target-org <TARGET_ORG>

Options

Flag	Description
`-t, --target-org <TARGET_ORG>`	Target org alias or username, as known to `sf org login`
`-f, --format <FORMAT>`	Output format: table, json or json-report. Default: `table`.
`-v, --verbose...`	Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)
`-q, --quiet`	Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
`--no-color`	Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
`-h, --help`	Print help (see a summary with '-h')

Full vulkro-sf org governance --help

Governance checks: is a backup configured (never "no backup" without evidence), the Einstein Trust Layer settings (data masking, audit trail, toxicity; zero retention is not readable), agent-to-owner attribution and each agent's running user, report and dashboard folders open to portal and community users, dashboards that run as a user with org-wide data access, CRM Analytics apps shared with all portal or partner users, what each installed package can reach (its permission sets, object access, connected apps and API-only holders), and secret rotation age (named and external credentials and auth providers unchanged for a year, certificates expiring within 30 days or expired).

Read-only: SELECT queries, metadata retrieves and a CRM Analytics REST read through your `sf` login. Salesforce-shipped components and managed package credentials are never reported.

Checks: SF-BACKUP-001/002, SF-AI-TRUST-001..004, SF-AI-AGENT-001/002, SF-REPORT-FOLDER-001, SF-DASHBOARD-RUNAS-001, SF-CRMA-APP-001, SF-PKG-ACCESS-001..003, SF-SECRET-AGE-001, SF-CERT-EXPIRY-001/002.

Formats: table, json (findings), json-report (findings, read coverage, backup, ai, exposure, packages, secrets, notes).

Exit codes: 0 = no findings; 1 = findings reported; 2 = error.

Usage: vulkro-sf org governance [OPTIONS] --target-org <TARGET_ORG>

Options:
  -t, --target-org <TARGET_ORG>
          Target org alias or username, as known to `sf org login`

  -f, --format <FORMAT>
          Output format: table, json or json-report
          
          [default: table]

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')

Command reference​

Options​

Command reference

Options