Skip to main content

vulkro-sf org least-privilege

Least-privilege recommender: per user, and especially per integration and API-only user, the effective permissions (profile + permission sets + permission set groups), the sensitive objects and fields they can read and export (the org's Data Sensitivity Level and Compliance Categorization, the offline metadata given with --metadata, and personal-data field names), the powerful permissions they hold, and the usage evidence the org exposes without Shield (last login, LoginHistory frequency and kind, OAuth token use, permission set assignment dates, Setup Audit Trail).

Command reference​

Generated from vulkro-sf org least-privilege --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Least-privilege recommender: per user, and especially per integration and API-only user, the effective permissions (profile + permission sets + permission set groups), the sensitive objects and fields they can read and export (the org's Data Sensitivity Level and Compliance Categorization, the offline metadata given with --metadata, and personal-data field names), the powerful permissions they hold, and the usage evidence the org exposes without Shield (last login, LoginHistory frequency and kind, OAuth token use, permission set assignment dates, Setup Audit Trail).

vulkro-sf org least-privilege [OPTIONS] --target-org <TARGET_ORG>

Options​

FlagDescription
-t, --target-org <TARGET_ORG>Target org alias or username, as known to sf org login
-f, --format <FORMAT>Output format: table, json or html. Default: table.
--metadata <METADATA>SFDX project or retrieved metadata folder: its field metadata (securityClassification, complianceGroup) adds to the org's own data classification.
--days <DAYS>Evidence window in days for logins and OAuth token use (7 to 365) Default: 90.
--xml-out <XML_OUT>Write each ranked user's suggested permission set XML into this folder (local files for review; nothing is deployed)
--output <OUTPUT>Write the report to this file instead of stdout.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf org least-privilege --help
Least-privilege recommender: per user, and especially per integration and API-only user, the effective permissions (profile + permission sets + permission set groups), the sensitive objects and fields they can read and export (the org's Data Sensitivity Level and Compliance Categorization, the offline metadata given with --metadata, and personal-data field names), the powerful permissions they hold, and the usage evidence the org exposes without Shield (last login, LoginHistory frequency and kind, OAuth token use, permission set assignment dates, Setup Audit Trail).

For each over-privileged user: what to keep, remove or review and why, the blast radius before and after (sensitive objects and fields reachable across all records), and a generated PermissionSet metadata XML to review. Nothing is ever deployed or changed: every read is a SELECT. "Unused" is never claimed: without Event Monitoring the org records no record reads or exports, so that access is marked review, and "no evidence of use in N days" names the evidence it rests on. Site guest users and Chatter Expert are not reviewed.

Checks: SF-LP-INTEG-001 (integration user with org-wide data access and no evidence of needing it), SF-LP-EXPORT-001 (user can export PII at scale), SF-PERM-002 (dormant administrator, the existing check).

Formats: table, json (report with findings, ranked users, per-user recommendations and XML), html (a self-contained page).

Exit codes: 0 = no findings; 1 = findings reported; 2 = error.

Usage: vulkro-sf org least-privilege [OPTIONS] --target-org <TARGET_ORG>

Options:
  -t, --target-org <TARGET_ORG>
          Target org alias or username, as known to `sf org login`

  -f, --format <FORMAT>
          Output format: table, json or html
          
          [default: table]

      --metadata <METADATA>
          SFDX project or retrieved metadata folder: its field metadata (securityClassification, complianceGroup) adds to the org's own data classification

      --days <DAYS>
          Evidence window in days for logins and OAuth token use (7 to 365)
          
          [default: 90]

      --xml-out <XML_OUT>
          Write each ranked user's suggested permission set XML into this folder (local files for review; nothing is deployed)

      --output <OUTPUT>
          Write the report to this file instead of stdout

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on