Methodology: what a safe Salesforce app should be

This page names the standard we measure Vulkro for Salesforce against and records, item by item, whether a detector covers it. The detector code is closed source; the standard, the rule IDs and the coverage status are public so you can check them.

The standard

We measure against four published sources:

1. Salesforce Well-Architected: three pillars (Trusted, Easy, Adaptable) with documented anti-patterns.
2. The AgentExchange (formerly AppExchange) Security Review: the Security Requirements Checklist and Salesforce's ranked Top 20 vulnerabilities found in reviews.
3. OWASP API Security Top 10: every finding carries an OWASP category.
4. The 2025-26 Salesforce breach classes: what actually compromised real orgs (OAuth token theft, guest-user exposure, vishing, ForcedLeak).

We also compare the Apex rules of the platform's own code analyzer, which every Salesforce review runs.

How coverage is recorded

Every requirement in those sources maps to one row with one state:

State	Meaning
Covered	A detector ships and emits a finding for it.
Partial	A detector covers part; the gap is named.
Planned	In scope, not shipped yet.
Out of scope	Not for a static, point-in-time CLI (DAST, behaviour analytics).

A row moves to Covered only when the detector and its finding ID ship in the same change, and the changelog records it.

Coverage summary

Group	Covered	Partial	Planned	Out of scope
AppExchange Top-20	15	0	0	5
Metadata types (security-relevant subset, ~30)	29	0	0	8
Apex security rules	10	0	0	0
Apex error-prone (security-adjacent)	4	0	0	2
Apex performance	3	0	0	0
Well-Architected anti-patterns (statically detectable subset)	14	0	0	1
Breach-class map	5	0	0	0

Top-20 coverage

#	Vulnerability	State	Detector
1	CRUD / FLS enforcement	Covered	apex_crud_fls
2	Insecure software version	Covered (JS only)	Vulnerable JavaScript libraries; Apex has no package manager
3	Sharing violation	Covered	apex_crud_fls, sf_agentforce
4	Insecure storage of sensitive data	Covered	Metadata and source secret checks
5	TLS / SSL configuration	Covered	TLS checks
6	Sensitive information in debug	Covered	sf_apex_logging
7	CSRF	Covered	SecuritySettings CSRF off; sf_apex_csrf
8	Stored and reflected XSS	Covered	sf_visualforce, sf_lwc
9	JavaScript not in static resources	Covered	sf_apex_url_safety
10	SOQL injection	Covered	Apex SOQL injection
11	Lightning: improper CSS load	Out of scope	Cosmetic
12	JavaScript in Salesforce DOM (Classic)	Out of scope	Classic only
13	Information disclosure on errors	Covered	sf_apex_url_safety (stack traces)
14	Aura CSS outside component	Out of scope	Cosmetic
15	Message channel exposed	Covered	sf_message_channels
16	Sensitive info in URL	Covered	sf_apex_url_safety
17	Insecure endpoint	Covered	RemoteSiteSetting and HTTP checks
18	Username or email enumeration	Out of scope	Needs DAST
19	Password management	Covered	SecuritySettings password policy
20	Password echo	Out of scope	Needs DAST

Details per item: AgentExchange Top-20 coverage.

Well-Architected

The Trusted pillar (Secure, Compliant, Reliable) holds every security requirement and the governor-limit reliability rules. Easy and Adaptable add design anti-patterns such as hardcoded IDs and URLs and multiple triggers per object. Security findings come from vulkro-sf scan; architecture findings come from vulkro-sf antipatterns.

Code: Apex, LWC, Aura, Visualforce

• Apex: a sharing mode on every class; CRUD/FLS through WITH USER_MODE, AccessLevel.USER_MODE or Security.stripInaccessible; bind variables or String.escapeSingleQuotes for SOQL; no MD5, SHA-1, static IV or Math.random() tokens; secrets in Named or External Credentials, never in source; nothing sensitive in System.debug.
• LWC and Aura: no innerHTML from untrusted data under lwc:dom="manual"; no aura:unescapedHtml on user content; message channels not exposed without need; scripts packaged as static resources.
• Visualforce: no escape="false" on user content; <apex:includeScript> only from static resources. See Visualforce.

All ten Apex security rules of the platform code analyzer, four of its six error-prone rules and its three performance rules are covered.

Metadata

About 30 metadata types are security relevant. Covered in depth: Profile, PermissionSet, ConnectedApp, NamedCredential, SecuritySettings (10 checks), StaticResource, and the Agentforce types (GenAiFunction, GenAiPromptTemplate, Bot). Also covered: permission set groups, external credentials, SAML and auth providers, login flows and IP ranges, remote sites, CORS and CSP trusted sites, certificates, sharing rules and sharing sets, sites, Experience Cloud networks, flows, triggers, outbound messages, external data sources and services, custom metadata, and web links. Out of scope: email templates, documents, approval, assignment and auto-response rules, groups and mobile settings.

Anti-patterns

AP-001 to AP-014 cover SOQL, DML and describe calls in loops, hardcoded IDs and URLs, empty catch blocks, trigger design, @future in triggers, missing tests, mixed DML, unbounded SOQL and SeeAllData=true. Report-design checks are out of scope. See Well-Architected anti-patterns.

Breach classes

Breach class	What Vulkro flags
OAuth token theft (2025, two vendor apps)	Connected Apps with Full scope and a refresh token
Experience Cloud guest-user exposure	Guest profiles that read sensitive objects or View All Records
Vishing that installs a malicious Connected App	The broad-scope app and dormant admins; the call itself is out of reach
ForcedLeak (Agentforce)	Agent Apex actions on without sharing classes; prompt-grounding check planned

Details: Breach class map.

Out of scope for the CLI

The CLI is point in time and keeps no standing connection to your org. Scheduled scans and change history across orgs are covered by Vulkro Cloud. Dynamic testing, behaviour analytics, password-reuse checks and account enumeration need a running system to probe, so a static scanner does not cover them.

See also: Well-Architected anti-patterns, AgentExchange readiness report