Sharing-rule field and record-type leakage

These checks read every *.sharingRules-meta.xml and flag criteria-based or owner-based rules that open sensitive records to a broad audience.

vulkro-sf scan ./force-app

A broad recipient is a Role, RoleAndSubordinates, a public Group or AllInternalUsers. Record access carries every field on the record, so a broad share of the record is a broad share of its sensitive fields.

Checks

Rule ID	What it finds	Fix
`sf-sharing-leak-field`	A rule shares records of an object that holds a sensitive field (tier-1 or tier-2 PII, credential, financial or government ID) to a broad recipient. Names the rule, object, field, access level and recipient.	Narrow `<sharedTo>`, lower `<accessLevel>` from `Edit` to `Read`, or restrict the field with FLS on the recipient's profile.
`sf-sharing-leak-recordtype`	A rule shares a sensitive record type (restricted, regulated or internal-only) to a broad recipient, collapsing the record-type boundary.	Share only to the intended population, or split the rule so the broad share covers only non-sensitive record types.

Example

Non-compliant: a restricted record type shared with edit access to every internal user.

<SharingRules xmlns="http://soap.sforce.com/2006/04/metadata">
    <sharingCriteriaRules>
        <fullName>Share_Escalations_Broadly</fullName>
        <accessLevel>Edit</accessLevel>
        <criteriaItems>
            <field>RecordTypeId</field>
            <operation>equals</operation>
            <value>Restricted_Medical</value>
        </criteriaItems>
        <sharedTo>
            <allInternalUsers></allInternalUsers>
        </sharedTo>
    </sharingCriteriaRules>
</SharingRules>

Compliant: read-only access for one scoped group, no sensitive record type.

<sharingCriteriaRules>
    <fullName>Share_With_Support_Queue</fullName>
    <accessLevel>Read</accessLevel>
    <criteriaItems>
        <field>Priority</field>
        <operation>equals</operation>
        <value>High</value>
    </criteriaItems>
    <sharedTo>
        <group>Tier2_Support</group>
    </sharedTo>
</sharingCriteriaRules>

Checks​

Example​

Checks

Example