`vulkro-sf org perms`

Checks the live org's profiles and permission sets for over-privilege, dormant admins and weak security settings.

vulkro-sf org perms --target-org <alias>
vulkro-sf org perms -o <alias> --format json

Finding	Severity	Meaning
`SF-PERM-001`	High or Medium	A custom profile or permission set grants Modify All Data or View All Data (High) or Author Apex (Medium).
`SF-PERM-002`	High	An admin account has not logged in for over 90 days.
`SF-SESSION-001`	Medium or Low	The idle session timeout is too long.
`SF-SESSION-002`	Info	Sessions are not locked to their login IP.
`SF-CLICKJACK-001`	High	Clickjack protection is off.
`SF-CSRF-001`	High	CSRF protection is off.
`SF-PWD-001`	Medium	The minimum password length is too short.
`SF-PWD-002`	Low	Password complexity is not enforced.
`SF-PWD-003`	Low	Passwords never expire.

Standard profiles and managed permission sets are skipped. A security setting that cannot be read is skipped, never guessed.

--explain adds a plain-language AI explanation of each finding on stderr. It never changes a finding or the exit code, and needs vulkro-sf ai setup (--ai-model and --ai-url override the model; --no-ai turns it off).