SecuritySettings and sharing

These checks cover org-level posture: Security.settings-meta.xml, org-wide defaults in *.object-meta.xml, *.sharingRules-meta.xml and <loginIpRanges> on profiles.

vulkro-sf scan ./force-app
vulkro-sf org report -o <alias> -O posture.html   # live org values

Checks

Rule ID	What it finds
`long-session-timeout`	`<sessionTimeout>` of `TwelveHours` or `TwentyFourHours`. The recommended ceiling is `TwoHours`.
`session-not-locked-to-ip`	`<lockSessionsToIp>false</lockSessionsToIp>`: a stolen session works from any IP.
`https-not-required`	`<requireHttps>false</requireHttps>`.
No forced logout on timeout	`<forceLogoutOnSessionTimeout>false</forceLogoutOnSessionTimeout>`.
`clickjack-nonsetup-user-off`	`<enableClickjackNonsetupUser>false</enableClickjackNonsetupUser>`: user pages can be framed.
`csrf-on-post-off`	`<enableCSRFOnPost>false</enableCSRFOnPost>`.
`no-login-attempt-limit`	`<maxLoginAttempts>NoLimit</maxLoginAttempts>`.
`passwords-never-expire`	`<expiration>Never</expiration>` in password policies.
Permissive org-wide default	An object with `<externalSharingModel>ReadWrite</externalSharingModel>`. Flagged for review.
Broad sharing on sensitive objects	A criteria-based sharing rule on `Account`, `Contact`, `Lead`, `Opportunity`, `Case` or `User` with `Edit` or `All` access shared to `Role`, `RoleAndSubordinates` or `Group`.
`loginiprange-missing-on-admin`	A profile with `ModifyAllData` or `ManageUsers` and no `<loginIpRanges>`.

These read metadata only. With a live org, vulkro-sf also retrieves the running org's SecuritySettings through your sf login, so the file does not need to be in source. A value it cannot read produces no finding.

Example

Non-compliant (eight findings):

<SecuritySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <sessionSettings>
        <sessionTimeout>TwelveHours</sessionTimeout>
        <lockSessionsToIp>false</lockSessionsToIp>
        <requireHttps>false</requireHttps>
        <forceLogoutOnSessionTimeout>false</forceLogoutOnSessionTimeout>
        <enableClickjackNonsetupUser>false</enableClickjackNonsetupUser>
        <enableCSRFOnPost>false</enableCSRFOnPost>
    </sessionSettings>
    <passwordPolicies>
        <maxLoginAttempts>NoLimit</maxLoginAttempts>
        <expiration>Never</expiration>
    </passwordPolicies>
</SecuritySettings>

Compliant:

<SecuritySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <sessionSettings>
        <sessionTimeout>TwoHours</sessionTimeout>
        <lockSessionsToIp>true</lockSessionsToIp>
        <requireHttps>true</requireHttps>
        <forceLogoutOnSessionTimeout>true</forceLogoutOnSessionTimeout>
        <enableClickjackNonsetupUser>true</enableClickjackNonsetupUser>
        <enableCSRFOnPost>true</enableCSRFOnPost>
    </sessionSettings>
    <passwordPolicies>
        <minimumPasswordLength>12</minimumPasswordLength>
        <maxLoginAttempts>FiveAttempts</maxLoginAttempts>
        <expiration>NinetyDays</expiration>
        <complexity>SpecialCharacters</complexity>
        <historyRestriction>10</historyRestriction>
    </passwordPolicies>
</SecuritySettings>

Metadata findings are suppressed with a fingerprint in .vulkroignore.

Checks​

Example​

Checks

Example