Skip to main content

vulkro-sf triage

[Advisory] Ask the local AI model to explain, in Salesforce terms, why findings matter for a security review.

Command reference​

Generated from vulkro-sf triage --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

[Advisory] Ask the local AI model to explain, in Salesforce terms, why findings matter for a security review.

vulkro-sf triage [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options​

FlagDescription
--ai-model <MODEL>AI model tag override (highest precedence). Overrides VULKRO_AI_MODEL, the saved vulkro-sf ai use selection, and the smart default.
--ai-url <URL>AI runtime base url override (OpenAI-compatible). A loopback url is allowed under VULKRO_OFFLINE; a cloud url is refused offline.
--no-aiDisable the AI layer for this run (deterministic scan only)
-f, --format <FORMAT>Output format: table (default, human advisory summary) or json (the advisory explanations as a JSON array) Default: table.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf triage --help
[Advisory] Ask the local AI model to explain, in Salesforce terms, why findings matter for a security review.

Advisory Salesforce triage: run the deterministic scan, then ask the local AI layer to explain, in plain Salesforce language, why the candidate findings matter for an AppExchange Security Review.

This is OPT-IN and ADVISORY. It never changes a deterministic finding, its severity, the SARIF / SBOM output, the `--gate-vs` gate, or an exit code. Only the mandatory-review candidate classes (CRUD / FLS, SOQL injection, with / without sharing, IDOR, `@AuraEnabled` / `@RestResource` entry-point authz) and reachability-uncertain findings are explained. The AI layer must first be configured with `vulkro-sf ai setup`; a loopback (local) model runs even under `VULKRO_OFFLINE` (nothing leaves the machine) while a cloud endpoint is refused offline.

Exit codes: 0 = no findings; 1 = findings reported; 2 = error. The AI layer never changes these: an unreachable model prints an actionable note and the deterministic result stands.

Usage: vulkro-sf triage [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
      --ai-model <MODEL>
          AI model tag override (highest precedence). Overrides VULKRO_AI_MODEL, the saved `vulkro-sf ai use` selection, and the smart default

      --ai-url <URL>
          AI runtime base url override (OpenAI-compatible). A loopback url is allowed under VULKRO_OFFLINE; a cloud url is refused offline

      --no-ai
          Disable the AI layer for this run (deterministic scan only)

  -f, --format <FORMAT>
          Output format: table (default, human advisory summary) or json (the advisory explanations as a JSON array)
          
          [default: table]

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on