LLM and AI response security
These checks treat LLM and Einstein output as untrusted input, re-rank findings by evidence, and review the MCP servers and tools wired into the org.
vulkro-sf scan ./force-app
Nothing here calls a model. The triage rules are deterministic and run offline; "AI" in the IDs names the surface being checked, not the method.
Checks
| Rule ID | What it finds |
|---|---|
| SF-LLM-SANITIZE-001 | An LLM response reaches dynamic SOQL, DML, markup output (Visualforce escape="false", innerHTML in LWC or Aura) or a callout endpoint with no escaping or validation. |
| SF-AI-TRIAGE-001 | Likely false-positive cluster: a test, fixture, example or generated file with three or more findings, at least three of them low priority. Advisory; does not gate the exit code on its own. |
| SF-AI-TRIAGE-002 | Fix-first: a Critical or High finding backed by at least two evidence signals and a multi-hop data-flow trace with a priority score of 80 or more. It keeps its own rule ID and fix; only the rank changes. |
| SF-MCP-000 | Inventory of every MCP server config, tool manifest and Apex-exposed MCP tool. Informational; does not gate the exit code. |
| SF-MCP-001 | An MCP tool description or Apex label contains instructions aimed at the model, such as "ignore previous" or "always call". |
| SF-MCP-002 | An MCP tool argument named like a credential or personal data field (password, token, SSN, card number). |
| SF-MCP-003 | An MCP server or tool declares a wildcard, full, refresh_token, View All Data or Modify All Data scope. |
Fixing SF-LLM-SANITIZE-001
Escape model output for the sink it lands in: String.escapeHtml4 before rendering, leave Visualforce escaping on, bind values instead of concatenating them into SOQL, and avoid manual DOM writes in LWC and Aura. These sanitizers on the path clear the finding: String.escapeHtml4, String.stripHtml, a Pattern.matches allowlist, or a length-bounded extraction. See CWE-79.
A custom sanitizer the rule does not recognize still produces a finding. If it is a reviewed exception, suppress it inline with an until= date.
See also: Agentforce security checks