vulkro-sf appexchange-report
Scans the project and maps the findings to the AgentExchange (formerly AppExchange) Security Review: the review categories (SF-ASRR-001 to 006), the pre-submit checklist (SF-PRESUBMIT-001 to 010) and the published checklist sections. It replaces the deprecated asrr and presubmit.
vulkro-sf appexchange-report . -o readiness.html
vulkro-sf appexchange-report . --format json --gate # CI gate
vulkro-sf appexchange-report . --import-code-analyzer ca.json --fpw-out FPW.json -o readiness.html
The default html report is one self-contained file (no CDN), which you can save as PDF. It always includes the submission packet: review-blocking findings ordered by estimated fix effort, imported Code Analyzer rows with drafted false-positive justifications, and the False Positives Whitelist summary.
Drafted justifications are never marked accepted: read each one before you upload. The packet does not replace the Code Analyzer report the review requires.
| Flag | What it does |
|---|---|
[PATH] | SFDX project or retrieved metadata. Default .. |
--format <html|table|json|markdown> | html is the report; the others print the checklist. Default html. |
-o, --output <file> | Write to a file instead of stdout. |
--gate | Exit 1 when a pre-submit item fails (for table, json, markdown). |
--packet | Add the submission packet to table, json or markdown output. |
--import-code-analyzer <file> | Import a Code Analyzer report (JSON, SARIF or CSV from sf code-analyzer run --output-file) and draft a justification for each row Vulkro has evidence for. Repeatable. |
--fpw-out <file> | Write the False Positives Whitelist (FPW.json), each entry marked accepted or draft. |
--prepared-for <name>, --prepared-by <name> | Attribution lines on the report cover. |
Exit codes
| Code | Meaning |
|---|---|
0 | html: every checklist section passes. Other formats: the report was produced. |
1 | html: at least one section fails. With --gate: at least one pre-submit item fails. |
2 | Error (unscannable path, unknown --format, unreadable Code Analyzer file). |
Imported Code Analyzer rows never change the exit code.
See also: AgentExchange readiness, HTML report format