SOC 2 mapping
This page maps the SOC 2 Trust Services Criteria that apply to a Salesforce deployment onto the vulkro-sf checks that produce evidence for them.
vulkro-sf compliance bundle soc2 ./force-app -o soc2-bundle.md
vulkro-sf compliance bundle soc2 ./force-app --format json -o soc2-bundle.json
The bundle lists each control with its evidence and a pass or fail verdict. Exit code 1 means at least one control failed. For web app, API and cloud evidence, see the general SOC 2 page.
Trust Services Criteria covered
| Criterion | Title | Checks that feed it |
|---|---|---|
| CC6.1 | Logical access provisioning | profiles-permsets (over-privilege, dormant admins), security-settings (password policy, MFA via session settings) |
| CC6.2 | User access removal | profiles-permsets (dormant admin detection) |
| CC6.3 | Least privilege | profiles-permsets (ModifyAllData, AuthorApex, CustomizeApplication outside System Administrator) |
| CC6.6 | External-system access | connected-apps (OAuth posture), named-credentials (cleartext endpoints, secrets in metadata) |
| CC6.7 | Sensitive data transmission | security-settings (requireHttps), connected-apps (OAuth scope, https:// callbacks) |
| CC6.8 | Malicious code prevention | apex (crypto misuse, hardcoded secrets), installed beta packages |
| CC7.1 | Vulnerability detection | The whole scan. |
| CC8.1 | Change management | CI/CD integration (a gate on every change) |
| CC9.1 | Risk mitigation | security-settings (hardening), connected-apps (third-party data flow risk) |
| C1.1 | Confidential information at rest | pii-map (sensitive object inventory) |
Per-detector control map (AP-001 through AP-055)
The Well-Architected anti-pattern checks (vulkro-sf antipatterns) contribute evidence to four Common Criteria.
CC6.1 - Logical and physical access controls
| Detector | What the finding shows |
|---|---|
| AP-015 PII in debug log | Customer data flowed into Setup audit, broader read population than data classification permits |
| AP-016 Record serialized into log | Same as AP-015, at field-set granularity |
| AP-017 PII in audit/log custom field | Customer data duplicated into non-encrypted store |
| AP-018 Agentforce action with no input validation | AI agent can issue arbitrary queries against unrestricted scope |
| AP-019 Agent with broad PII access | Agent reachable from chat owns Read/Edit/All on a PII object |
| AP-026 Trigger silent-swallow | Trigger-context error did not trigger detection / response |
| AP-029 Cross-package class no Type.forName | Optional dependency not guarded, runtime exposure |
| AP-032 Lookup where master-detail required | Sharing rule on parent did not protect child |
| AP-034 Profile count above threshold | Permission audit harder to perform at scale |
| AP-035 Permission-set sprawl | Effective permission of any user is opaque |
| AP-036 Connected App sprawl | Third-party reachable surface above review threshold |
| AP-037 Agentforce action sprawl | AI surface above security-review threshold |
| AP-040 God method | Service code mixes query + DML + logic, harder to audit access decisions |
| AP-041 @AuraEnabled with inline SOQL | Controller bypasses selector layer; access path not abstracted |
| AP-044 REST endpoint without auth check | Endpoint reachable without identity verification |
| AP-046 Flow runs in System mode against PII | Sharing rules bypassed; auditor cannot confirm enforcement |
| AP-047 List Custom Setting holds secret | Credentials readable by all authenticated users |
| AP-048 Public Custom Metadata holds secret | Credentials readable through standard SOQL |
CC6.6 - Authentication and credential management
| Detector | What the finding shows |
|---|---|
| AP-012 Hardcoded callout URL (no Named Credential) | Outbound credential not routed through documented rotation point |
| AP-022 Agent grounding via Drift-class Connected App | Authentication route inherits a known-vulnerable OAuth surface |
| AP-024 Partial-success DML without SaveResult | Auth-driven failures dropped silently |
| AP-025 Callout failure swallowed by empty catch | Auth failures not surfaced to detection |
| AP-027 Installed package on Beta | Auth path against a package with no upgrade guarantee |
| AP-042 Callout without retry path | Auth-related transient failures become hard transaction failures |
| AP-043 Callout without setTimeout | Long-running auth requests block the transaction budget |
| AP-045 External Service Registration with NoAuthentication | Integration bypasses credential check entirely |
| AP-052 Browser localStorage / sessionStorage access | Session-scoped credentials cross user boundaries on shared devices |
CC7.2 - Detection and monitoring of system events
| Detector | What the finding shows |
|---|---|
| AP-001 SOQL in loop | Governor-limit risk that surfaces only under load |
| AP-002 DML in loop | Governor-limit risk under load |
| AP-004 Empty catch | Operationally significant failures not surfaced |
| AP-008 Schema describe in loop | Performance failure mode not monitored |
| AP-013 SOQL without WHERE/LIMIT | Resource-exhaustion failure mode not bounded |
| AP-023 Catch-and-rethrow without context | Stack frames lost; incident response harder |
| AP-030 Formula >3 levels deep | Deploy-time failure mode not surfaced until production |
| AP-031 Junction object with two lookups | Cascade-delete semantics not enforced |
| AP-033 Flow Get Records in loop | Governor-limit failure not detected at design time |
| AP-038 Custom Apex reimplementing Validation Rule | Validation failure not visible to standard admin audit |
| AP-049 PII write without paired delete | Right-to-erasure event has no execution path |
| AP-050 LWC / Aura direct DOM write | XSS event not detected by framework auto-escape |
| AP-051 LWC / Aura eval / new Function | Script-injection event not detected by review |
| AP-053 Visualforce actionPoller below 60s | Resource-exhaustion failure mode under load |
| AP-054 Visualforce escape=false on outputText | XSS event reachable through merge fields |
| AP-055 Visualforce third-party off-platform script | Supply-chain event surface outside CSP boundary |
CC8.1 - Change management
| Detector | What the finding shows |
|---|---|
| AP-003 Hardcoded record ID | Change to record IDs requires source edit + deploy |
| AP-005 Trigger logic in body | Change required without handler-class indirection |
| AP-006 @future in trigger | Async pattern decision baked into the trigger surface |
| AP-007 Apex class with no test | Change cannot demonstrate the 75% coverage gate |
| AP-009 Multiple triggers per object | Order-of-execution change requires coordination doc |
| AP-010 Recursive trigger DML | Recursion-guard change requires source edit |
| AP-011 Mixed-DML transaction | Setup/non-setup boundary change requires transaction rewrite |
| AP-014 @isTest(SeeAllData=true) | Test does not survive security review submission |
| AP-028 Hardcoded namespace prefix | Repackage / re-namespace change requires source edit |
| AP-039 Flow reimplementing Approval Process | Change-management view does not see this approval in standard report |
What to hand the auditor
- The bundle from
vulkro-sf compliance bundle soc2. - The SARIF file from each scan (
vulkro-sf scan --format sarif). - An attestation over the bundle:
vulkro-sf compliance attest soc2-bundle.md. - CI logs from the gate on every change (CC8.1 evidence).
Not covered
CC1 to CC5 (control environment, communication, risk assessment, monitoring, control activities) need written policy, training records and governance. A scanner does not produce them.
See also: Compliance overview, Compliance mapping