vulkro-sf review
Show the findings that sit on lines your git change touched, like a code review.
Command reference
Generated from vulkro-sf review --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.
Show the findings that sit on lines your git change touched, like a code review.
vulkro-sf review [OPTIONS] [PATH]
Arguments
| Argument | Description |
|---|---|
[PATH] | Path to the SFDX project or retrieved metadata. Defaults to . Default: .. |
Options
| Flag | Description |
|---|---|
--staged | Review only staged changes (git diff --cached) |
--last-commit | Review the most recent commit (HEAD~1..HEAD) |
--commit <REV> | Review a single commit's own diff (<rev>^..<rev>) |
--range <SPEC> | Review an arbitrary range: A..B, A...B (merge-base), or a bare <ref> (treated as <ref>..HEAD) |
-f, --format <FORMAT> | Output format: human (default), json, sarif, github-annotations, or gh-pr-inline. The last three carry only the NEW rows (findings this change introduced plus access changes), like scan --gate-vs, so a pull request is annotated with exactly what it changed. github-annotations and gh-pr-inline also need the Pro capability pr-comments, as they do on scan. The format never changes the exit code. Default: human. |
--context <N> | Diff context lines. Overrides VULKRO_REVIEW_CONTEXT; default 3. |
--baseline <REF> | Precise NEW-vs-existing classification by scanning the given base ref in a temporary worktree and comparing finding fingerprints (slower). Without it, a finding on an added line is NEW and one on an unchanged context line is existing. |
--fail-on <FAIL_ON> | Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of critical, high, medium, low, or none. Default low. none never gates. Default: low. |
-v, --verbose... | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins) |
-q, --quiet | Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged. |
--no-color | Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb. |
-h, --help | Print help (see a summary with '-h') |
Full vulkro-sf review --help
Show the findings that sit on lines your git change touched, like a code review.
Review the security findings on your git changes: scan the Salesforce source, then show only the findings that land on the lines this change touched, rendered as an inline diff. Each finding is tagged NEW (introduced by this change) or existing (already on an unchanged line).
Access changes: when the change touches Salesforce metadata, the review also says what it GRANTS and to whom, by comparing the metadata before and after the change: a guest or external user gaining read or edit on a sensitive field, a dangerous system permission, a weakened OAuth app, a prompt template grounded on data an external user can edit, and more. Access changes are NEW by construction, are listed first, and count toward --fail-on like any NEW finding.
Scope (pick at most one; default is the working tree): (default) uncommitted changes: `git diff HEAD` + untracked files --staged only staged changes: `git diff --cached` --last-commit the most recent commit: HEAD~1..HEAD --commit <rev> that commit's own diff: <rev>^..<rev> --range <spec> A..B, A...B (merge-base), or a bare <ref> (since <ref>)
Pull-request gate (annotates only what the change introduced): vulkro-sf review --range origin/main...HEAD --fail-on high --format gh-pr-inline
Environment variables (CLAUDE.md rule 10): VULKRO_REVIEW_CONTEXT Default diff context lines (overridden by --context). Default 3.
Exit codes (CLAUDE.md rule 8), for every --format: 0 no NEW findings (access changes included) at or above --fail-on. 1 one or more NEW findings at or above --fail-on (the review is the report). Use `--fail-on none` for a report that never gates. 2 error: not a git repo, bad ref, unknown --format, or scan failure.
Usage: vulkro-sf review [OPTIONS] [PATH]
Arguments:
[PATH]
Path to the SFDX project or retrieved metadata. Defaults to `.`
[default: .]
Options:
--staged
Review only staged changes (`git diff --cached`)
--last-commit
Review the most recent commit (HEAD~1..HEAD)
--commit <REV>
Review a single commit's own diff (`<rev>^..<rev>`)
--range <SPEC>
Review an arbitrary range: `A..B`, `A...B` (merge-base), or a bare `<ref>` (treated as `<ref>..HEAD`)
-f, --format <FORMAT>
Output format: `human` (default), `json`, `sarif`, `github-annotations`, or `gh-pr-inline`. The last three carry only the NEW rows (findings this change introduced plus access changes), like `scan --gate-vs`, so a pull request is annotated with exactly what it changed. `github-annotations` and `gh-pr-inline` also need the Pro capability `pr-comments`, as they do on `scan`. The format never changes the exit code
[default: human]
--context <N>
Diff context lines. Overrides VULKRO_REVIEW_CONTEXT; default 3
--baseline <REF>
Precise NEW-vs-existing classification by scanning the given base ref in a temporary worktree and comparing finding fingerprints (slower). Without it, a finding on an added line is NEW and one on an unchanged context line is existing
--fail-on <FAIL_ON>
Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of `critical`, `high`, `medium`, `low`, or `none`. Default `low`. `none` never gates
[default: low]
-v, --verbose...
Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)
-q, --quiet
Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged
--no-color
Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb
-h, --help
Print help (see a summary with '-h')