vulkro-sf org
Inspect a connected Salesforce org through your existing Salesforce CLI login.
Command reference
Generated from vulkro-sf org --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.
Inspect a connected Salesforce org through your existing Salesforce CLI login.
vulkro-sf org [OPTIONS] <COMMAND>
| Command | What it does |
|---|---|
status | Verify connectivity and print the connected org's identity. |
perms | Audit permission sets and profiles for over-privilege (SF-PERM-001) |
packages | List installed packages and flag unverified ones (SF-PKG-001 / SF-PKG-002) |
effective-perms | Audit cumulative effective permissions held by users right now. |
connected-apps | Audit live Connected Apps for OAuth posture (SF-CONNECTED-APP-002/-003/-004) |
named-credentials | Audit live Named Credentials (SF-NC-LIVE-001/-002/-003) |
guest-live | Audit Experience Cloud guest-user posture (SF-GUEST-LIVE-001/-002/-003/-004) |
domain | Audit MyDomain SSL posture (SF-DOMAIN-001/-002) |
mail | Audit OrgWideEmailAddress and EmailServicesAddress (SF-MAIL-001/-002) |
login-history | LoginHistory anomalies (SF-LOGIN-HISTORY-001/-002/-003) plus the per-profile login-policy audit (SF-LOGIN-POLICY-001/-002/-003: missing IP allowlist, phishing-resistant / high-assurance MFA gap, over-long per-profile session timeout) |
audit-trail | SetupAuditTrail privilege escalation tracking (SF-AUDIT-TRAIL-001/-002) |
health-check | Salesforce-computed Health Check score (SF-HEALTH-CHECK-001) |
session | Live AuthSession audit: long-lived and stale sessions (SF-SESSION-LIVE-001 / -002 / -003) |
mfa | Live MFA enforcement audit (SF-MFA-003 runs; SF-MFA-001 / -002 cannot) |
sharing-rules | Audit standard-object sharing entries for over-broad write access, portal-user manual shares, and criteria-based shares covering many records (SF-SHARING-001 / -002 / -003) |
integration-users | Audit active integration-user accounts for excess privilege, human reuse of the integration login, and staleness (SF-INTEG-USER-001 / -002 / -003), plus the service-account lifecycle audit (SF-SVC-USER-001 / -002 / -003) |
threat-detection | Event Monitoring Lite: threat detection from the event logs every org already has, without Shield. Reads the last day's free EventLogFile types (Login, Logout, API Total Usage; Report Export, Bulk API and URI when the org has them), LoginHistory and SetupAuditTrail, turns them into a compact normalised event list (no record data, usernames masked), and reports suspicious activity to investigate: |
governance | Governance checks: is a backup configured (never "no backup" without evidence), the Einstein Trust Layer settings (data masking, audit trail, toxicity; zero retention is not readable), agent-to-owner attribution and each agent's running user, report and dashboard folders open to portal and community users, dashboards that run as a user with org-wide data access, CRM Analytics apps shared with all portal or partner users, what each installed package can reach (its permission sets, object access, connected apps and API-only holders), and secret rotation age (named and external credentials and auth providers unchanged for a year, certificates expiring within 30 days or expired) |
oauth-risk | Connected-App & OAuth Risk Center: every connected app, External Client App and app seen through its OAuth tokens, rated from its scopes, IP relaxation, permitted users, refresh-token / PKCE / device-flow policy, callback URLs and who authorised it; the holders of "Use Any API Client" and "Approve Uninstalled Connected Apps"; integration users with org-wide data access; a revoke list (recommendations only: nothing is revoked or changed); and a post-incident check that matches LoginHistory and app names against the published indicators of the 2025 Salesforce OAuth campaigns (a match is a reason to investigate, not proof of a breach) |
least-privilege | Least-privilege recommender: per user, and especially per integration and API-only user, the effective permissions (profile + permission sets + permission set groups), the sensitive objects and fields they can read and export (the org's Data Sensitivity Level and Compliance Categorization, the offline metadata given with --metadata, and personal-data field names), the powerful permissions they hold, and the usage evidence the org exposes without Shield (last login, LoginHistory frequency and kind, OAuth token use, permission set assignment dates, Setup Audit Trail) |
field-audit-trail | Audit Field Audit Trail retention + PII history-tracking gaps. |
sandbox-refresh-lag | Audit sandbox refresh lag (DevHub target required) |
platform-limits | Audit platform governor / limit utilization health (SF-LIMITS-001 / -002) |
psg-composition | Audit PermissionSetGroup composition for effective god-mode grants (SF-PSG-COMPOSITION-001) |
event-monitoring | Audit Salesforce Shield Event Monitoring log files for anomaly patterns (SF-EVENT-MON-001 through -009 and -019 through -024) |
trust-status | Cross-reference the org's instance against a Salesforce Trust incident snapshot (Tier 6 subsystem 3) |
context | Write the org context (vulkro.sf-org-context/v1) the engine and the Cloud use to judge findings against the live org: every profile, permission set and permission set group with its ACTIVE holders (profile users plus direct and group assignments) and its object Read / Edit / View All / Modify All; whether each class, page, flow, group, remote site, CSP site, connected app, package and user was built by the customer, shipped by Salesforce, or installed from a package; which add-ons are licensed (Field Audit Trail, Platform Encryption, Event Monitoring); the guest site profiles and the objects with a guest sharing rule; and the scanner's own connection. Every read is a SELECT query or a metadata retrieve through your sf login; nothing in the org is changed. The format is documented in cloud/SF_ORG_CONTEXT.md |
forensic-snapshot | Capture a point-in-time, offline-analysable forensic snapshot of an org's identity and sharing posture and write it to a single JSON bundle. The bundle pulls the live state a responder needs at incident time (users, permission-set assignments, the permission sets themselves, organization-wide defaults, sharing rules, and recent LoginHistory) through the user's authenticated sf CLI, then writes one self-contained JSON file the responder can carry to an air-gapped analysis box. No findings are produced here: this is a data-collection handoff, not an audit. Run logs analyze or org-family audits against the captured data offline. |
report | Generate a single shareable, reviewer-ready live-org security posture report (HTML or Markdown) for a connected org. |
Options
| Flag | Description |
|---|---|
-v, --verbose... | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins) |
-q, --quiet | Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged. |
--no-color | Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb. |
-h, --help | Print help (see a summary with '-h') |
Full vulkro-sf org --help
Inspect a connected Salesforce org through your existing Salesforce CLI login.
Inspect a connected Salesforce org through your own `sf` CLI login.
Reads the org over your own Salesforce CLI session (an outbound call to Salesforce, by design). The OAuth token stays in the `sf` CLI, the analysis runs on this machine, and these commands send no org data or findings to Vulkro (only the background licence heartbeat runs, which carries usage counts and command names; VULKRO_OFFLINE=1 turns it off). Requires the `sf` CLI installed and `sf org login web` completed.
Every posture audit except `org perms` also accepts `--format json-report`: the findings plus the run's read coverage (`partial`, `truncated`, `unavailable`, `window_days`), so a caller can tell a clean org from an audit that could not read all of it.
Every posture audit that reports findings (all but `status`, `context`, `forensic-snapshot`, `report` and `least-privilege`) also accepts `--format ocsf`: OCSF 1.3.0 Detection Finding events (class_uid 2004, type_uid 200401), one JSON object per line, naming the org (Id, alias, instance) and carrying the MITRE ATT&CK technique where the check maps to one, for a Security Mesh, a SIEM or a security data lake.
Exit codes: 0 = success / no findings; 1 = posture findings reported; 2 = error.
Usage: vulkro-sf org [OPTIONS] <COMMAND>
Commands:
status Verify connectivity and print the connected org's identity
perms Audit permission sets and profiles for over-privilege (SF-PERM-001)
packages List installed packages and flag unverified ones (SF-PKG-001 / SF-PKG-002)
effective-perms Audit cumulative effective permissions held by users right now
connected-apps Audit live Connected Apps for OAuth posture (SF-CONNECTED-APP-002/-003/-004)
named-credentials Audit live Named Credentials (SF-NC-LIVE-001/-002/-003)
guest-live Audit Experience Cloud guest-user posture (SF-GUEST-LIVE-001/-002/-003/-004)
domain Audit MyDomain SSL posture (SF-DOMAIN-001/-002)
mail Audit OrgWideEmailAddress and EmailServicesAddress (SF-MAIL-001/-002)
login-history LoginHistory anomalies (SF-LOGIN-HISTORY-001/-002/-003) plus the per-profile login-policy audit (SF-LOGIN-POLICY-001/-002/-003: missing IP allowlist, phishing-resistant / high-assurance MFA gap, over-long per-profile session timeout)
audit-trail SetupAuditTrail privilege escalation tracking (SF-AUDIT-TRAIL-001/-002)
health-check Salesforce-computed Health Check score (SF-HEALTH-CHECK-001)
session Live AuthSession audit: long-lived and stale sessions (SF-SESSION-LIVE-001 / -002 / -003)
mfa Live MFA enforcement audit (SF-MFA-003 runs; SF-MFA-001 / -002 cannot)
sharing-rules Audit standard-object sharing entries for over-broad write access, portal-user manual shares, and criteria-based shares covering many records (SF-SHARING-001 / -002 / -003)
integration-users Audit active integration-user accounts for excess privilege, human reuse of the integration login, and staleness (SF-INTEG-USER-001 / -002 / -003), plus the service-account lifecycle audit (SF-SVC-USER-001 / -002 / -003)
threat-detection Event Monitoring Lite: threat detection from the event logs every org already has, without Shield. Reads the last day's free EventLogFile types (Login, Logout, API Total Usage; Report Export, Bulk API and URI when the org has them), LoginHistory and SetupAuditTrail, turns them into a compact normalised event list (no record data, usernames masked), and reports suspicious activity to investigate:
governance Governance checks: is a backup configured (never "no backup" without evidence), the Einstein Trust Layer settings (data masking, audit trail, toxicity; zero retention is not readable), agent-to-owner attribution and each agent's running user, report and dashboard folders open to portal and community users, dashboards that run as a user with org-wide data access, CRM Analytics apps shared with all portal or partner users, what each installed package can reach (its permission sets, object access, connected apps and API-only holders), and secret rotation age (named and external credentials and auth providers unchanged for a year, certificates expiring within 30 days or expired)
oauth-risk Connected-App & OAuth Risk Center: every connected app, External Client App and app seen through its OAuth tokens, rated from its scopes, IP relaxation, permitted users, refresh-token / PKCE / device-flow policy, callback URLs and who authorised it; the holders of "Use Any API Client" and "Approve Uninstalled Connected Apps"; integration users with org-wide data access; a revoke list (recommendations only: nothing is revoked or changed); and a post-incident check that matches LoginHistory and app names against the published indicators of the 2025 Salesforce OAuth campaigns (a match is a reason to investigate, not proof of a breach)
least-privilege Least-privilege recommender: per user, and especially per integration and API-only user, the effective permissions (profile + permission sets + permission set groups), the sensitive objects and fields they can read and export (the org's Data Sensitivity Level and Compliance Categorization, the offline metadata given with --metadata, and personal-data field names), the powerful permissions they hold, and the usage evidence the org exposes without Shield (last login, LoginHistory frequency and kind, OAuth token use, permission set assignment dates, Setup Audit Trail)
field-audit-trail Audit Field Audit Trail retention + PII history-tracking gaps
sandbox-refresh-lag Audit sandbox refresh lag (DevHub target required)
platform-limits Audit platform governor / limit utilization health (SF-LIMITS-001 / -002)
psg-composition Audit PermissionSetGroup composition for effective god-mode grants (SF-PSG-COMPOSITION-001)
event-monitoring Audit Salesforce Shield Event Monitoring log files for anomaly patterns (SF-EVENT-MON-001 through -009 and -019 through -024)
trust-status Cross-reference the org's instance against a Salesforce Trust incident snapshot (Tier 6 subsystem 3)
context Write the org context (`vulkro.sf-org-context/v1`) the engine and the Cloud use to judge findings against the live org: every profile, permission set and permission set group with its ACTIVE holders (profile users plus direct and group assignments) and its object Read / Edit / View All / Modify All; whether each class, page, flow, group, remote site, CSP site, connected app, package and user was built by the customer, shipped by Salesforce, or installed from a package; which add-ons are licensed (Field Audit Trail, Platform Encryption, Event Monitoring); the guest site profiles and the objects with a guest sharing rule; and the scanner's own connection. Every read is a SELECT query or a metadata retrieve through your `sf` login; nothing in the org is changed. The format is documented in `cloud/SF_ORG_CONTEXT.md`
forensic-snapshot Capture a point-in-time, offline-analysable forensic snapshot of an org's identity and sharing posture and write it to a single JSON bundle. The bundle pulls the live state a responder needs at incident time (users, permission-set assignments, the permission sets themselves, organization-wide defaults, sharing rules, and recent LoginHistory) through the user's authenticated `sf` CLI, then writes one self-contained JSON file the responder can carry to an air-gapped analysis box. No findings are produced here: this is a data-collection handoff, not an audit. Run `logs analyze` or `org`-family audits against the captured data offline
report Generate a single shareable, reviewer-ready live-org security posture report (HTML or Markdown) for a connected org
help Print this message or the help of the given subcommand(s)
Options:
-v, --verbose...
Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)
-q, --quiet
Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged
--no-color
Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb
-h, --help
Print help (see a summary with '-h')