External attack-surface inventory

These checks list every part of the project that is reachable from outside the org, so a reviewer can confirm each one is intended and protected.

vulkro-sf scan ./force-app
vulkro-sf entrypoints ./force-app

An inventory row is not a vulnerability. It makes the external footprint explicit.

Checks

Rule ID	What it lists	What to confirm
SF-ATTACK-SURFACE-000	One summary row counting every external surface found, by class.	Size of the footprint; then walk the rows below.
SF-ATTACK-SURFACE-001	Each Force.com Site or Experience Cloud site.	The site is meant to be public; review the guest profile and every controller it reaches.
SF-ATTACK-SURFACE-002	Each Experience Cloud network with self-registration enabled.	Anonymous sign-up is intended; the guest and self-registered profiles hold minimum access.
SF-ATTACK-SURFACE-003	Each sharing rule or public group that shares to a broad recipient.	Tighten criteria and membership to an intended audience.
SF-ATTACK-SURFACE-004	Each connected app that declares an OAuth callback URL.	The app is a known, approved integration with the right scope.
SF-ATTACK-SURFACE-005	Each Apex class exposing `@RestResource`, an HTTP verb method (`@HttpGet`, `@HttpPost`, ...) or a `webservice` method.	CRUD, FLS, sharing and an auth check inside the method.
SF-ATTACK-SURFACE-006	Each chromeless Visualforce page, the shape a public site serves to anonymous traffic.	The page is meant to be public; its controller escapes request parameters.

For what a guest visitor can actually reach, with proof, run vulkro-sf exposure.