Skip to main content

vulkro-sf org oauth-risk

Connected-App & OAuth Risk Center: every connected app, External Client App and app seen through its OAuth tokens, rated from its scopes, IP relaxation, permitted users, refresh-token / PKCE / device-flow policy, callback URLs and who authorised it; the holders of "Use Any API Client" and "Approve Uninstalled Connected Apps"; integration users with org-wide data access; a revoke list (recommendations only: nothing is revoked or changed); and a post-incident check that matches LoginHistory and app names against the published indicators of the 2025 Salesforce OAuth campaigns (a match is a reason to investigate, not proof of a breach).

Command reference​

Generated from vulkro-sf org oauth-risk --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Connected-App & OAuth Risk Center: every connected app, External Client App and app seen through its OAuth tokens, rated from its scopes, IP relaxation, permitted users, refresh-token / PKCE / device-flow policy, callback URLs and who authorised it; the holders of "Use Any API Client" and "Approve Uninstalled Connected Apps"; integration users with org-wide data access; a revoke list (recommendations only: nothing is revoked or changed); and a post-incident check that matches LoginHistory and app names against the published indicators of the 2025 Salesforce OAuth campaigns (a match is a reason to investigate, not proof of a breach).

vulkro-sf org oauth-risk [OPTIONS] --target-org <TARGET_ORG>

Options​

FlagDescription
-t, --target-org <TARGET_ORG>Target org alias or username, as known to sf org login
-f, --format <FORMAT>Output format: table, json or json-report. Default: table.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf org oauth-risk --help
Connected-App & OAuth Risk Center: every connected app, External Client App and app seen through its OAuth tokens, rated from its scopes, IP relaxation, permitted users, refresh-token / PKCE / device-flow policy, callback URLs and who authorised it; the holders of "Use Any API Client" and "Approve Uninstalled Connected Apps"; integration users with org-wide data access; a revoke list (recommendations only: nothing is revoked or changed); and a post-incident check that matches LoginHistory and app names against the published indicators of the 2025 Salesforce OAuth campaigns (a match is a reason to investigate, not proof of a breach).

Read-only: SELECT queries and metadata retrieves through your `sf` login. Salesforce-owned apps and the scanner's own connection are listed but never reported.

Checks: SF-OAUTH-APP-001..007, SF-OAUTH-TOKEN-001, SF-OAUTH-PERM-001/002, SF-OAUTH-INTEG-001, SF-OAUTH-IOC-001..003.

Formats: table, json (findings), json-report (findings, read coverage, apps, revoke_list, holders, integration_users, incident_check).

Exit codes: 0 = no findings; 1 = findings reported; 2 = error.

Usage: vulkro-sf org oauth-risk [OPTIONS] --target-org <TARGET_ORG>

Options:
  -t, --target-org <TARGET_ORG>
          Target org alias or username, as known to `sf org login`

  -f, --format <FORMAT>
          Output format: table, json or json-report
          
          [default: table]

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on