Skip to main content

vulkro-sf org record-secrets

Opt-in scan of record text for pasted credentials (SF-RECORD-SECRET-001).

Command reference​

Generated from vulkro-sf org record-secrets --help (vulkro-sf 0.33.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Opt-in scan of record text for pasted credentials (SF-RECORD-SECRET-001).

vulkro-sf org record-secrets [OPTIONS] --target-org <TARGET_ORG>

Options​

FlagDescription
-t, --target-org <TARGET_ORG>Target org alias or username, as known to sf org login
-f, --format <FORMAT>Output format: table, json, json-report or ocsf. Default: table.
--i-understand-this-reads-record-dataConfirm you are authorised to read record data on this org. Without it the scan reads nothing and exits 2.
--max-records <N>Newest records read per object (default 2000, at most 10000)
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf org record-secrets --help
Opt-in scan of record text for pasted credentials (SF-RECORD-SECRET-001).

An opt-in read of Case, EmailMessage, Note, FeedItem and small text ContentVersion records on your OWN org (the newest `--max-records` per object, default 2000; text files of at most 256 KB), looking for provider-format secrets (cloud keys, API tokens) pasted into tickets, emails, notes and feed posts: the data the 2025 Salesloft Drift intruders mined. Values are processed locally and never printed: the output names the record Id, object, field and provider only.

Off unless you pass `--i-understand-this-reads-record-data`. Refuses under VULKRO_OFFLINE (or VULKRO_SF_OFFLINE), because it queries the org through your `sf` login. An object that could not be read is reported as not checked (Info), never as clean.

Exit codes: 0 no credentials found, 1 credentials found, 2 refused or error.

Usage: vulkro-sf org record-secrets [OPTIONS] --target-org <TARGET_ORG>

Options:
  -t, --target-org <TARGET_ORG>
          Target org alias or username, as known to `sf org login`

  -f, --format <FORMAT>
          Output format: table, json, json-report or ocsf
          
          [default: table]

      --i-understand-this-reads-record-data
          Confirm you are authorised to read record data on this org. Without it the scan reads nothing and exits 2

      --max-records <N>
          Newest records read per object (default 2000, at most 10000)

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on