The sf CLI handoff

vulkro-sf has no Salesforce login of its own. Every live-org read runs through the official Salesforce CLI (sf) with the alias you name, so the OAuth token never leaves the sf credential store.

sf org login web --alias my-prod
vulkro-sf org status --target-org my-prod

What happens on a live-org command

1. You run, for example, vulkro-sf org perms --target-org my-prod.
2. vulkro-sf runs sf commands against that alias: sf data query (SOQL, including the Tooling API), sf project retrieve start (metadata into a temporary folder) and sf api request rest (REST reads).
3. sf refreshes the token if needed, makes the call to your org, and returns the result.
4. vulkro-sf analyses the result on your machine. The token is never passed to it, stored by it or logged. Nothing is sent to Vulkro.

All of this only reads. Nothing in the org is created, changed or deleted.

What is read

Setup and security data: profiles, permission sets and assignments, settings, sharing rules, Connected Apps and OAuth token usage, credentials, installed packages, sites, users, LoginHistory, Setup Audit Trail and event log files. It does not read the contents of business records; a few checks count records with SELECT COUNT(). The full list is on Live-org setup.

Why use sf

• One place to revoke. Revoking the Salesforce CLI's access also cuts off vulkro-sf.
• No second credential store. The refresh token stays in the store sf already uses on your OS.
• Sandboxes, scratch orgs and instance changes are handled by sf.

Several orgs

vulkro-sf accepts any alias sf knows:

sf org list
vulkro-sf org perms    --target-org my-sandbox
vulkro-sf org packages --target-org my-prod

Aliases are per machine. A CI runner logs in on its own, usually with the JWT bearer flow (see GitHub Actions or GitLab CI).

Revoking access

In Setup, open Connected Apps OAuth Usage, find Salesforce CLI, and revoke or block it. Every sf and vulkro-sf command against that org then fails until you run sf org login web again. Do this if a laptop is lost.

Offline

VULKRO_OFFLINE=1 refuses every live-org command, because each one contacts Salesforce.

See also: Live-org setup, Live-org verification