OAuth scope and third-party integrations

These checks cover OAuth scopes on connected apps, auth providers and credentials, and the data Apex sends out through Named Credential callouts.

vulkro-sf scan ./force-app
vulkro-sf org oauth-risk -o <alias>   # live org

Checks

Rule ID	What it finds	Fix
SF-OAUTH-SCOPE-001	A third-party connected app, auth provider or credential granted `full`, `refresh_token` or `api` with no IP or scope constraint.	Use the narrowest scope and bind the app to an IP allowlist.
SF-OAUTH-SCOPE-002	Apex forwarding request input (Aura, REST or page parameters) into the body or URL of a Named Credential callout in the same file.	Validate and map caller input to known-safe values before the callout.
SF-OAUTH-SCOPE-003	`refresh_token` granted to an auth provider or app not on the verified provider list.	Drop `refresh_token` unless offline access is needed; grant it only to verified providers.
SF-OAUTH-SCOPE-004	A connected app with an over-broad scope and no admin pre-approval.	Require admin-approved users.
SF-OAUTH-SCOPE-005	A Named or External Credential holding an over-broad scope under a shared named principal.	Give each integration its own principal with the minimum scope.
SF-OAUTH-SCOPE-006	Summary row naming every over-broad, unconstrained third-party OAuth grant in the project.	Work through the findings it lists.
SF-OAUTH-SCOPE-007	A connected app with `full` scope, no IP constraint and no admin pre-approval together.	Fix all three.
SF-OAUTH-SCOPE-008	A client credentials flow that runs as an administrator, with `full` or `api` scope and relaxed IP restrictions.	Run as a dedicated, minimum-privilege integration user.