vulkro-sf org effective-perms
Reports the permissions active users in the live org actually hold today, not just what profiles and permission sets grant.
vulkro-sf org effective-perms --target-org <alias>
vulkro-sf org effective-perms -o <alias> --format sarif > effective-perms.sarif
--format takes table (default), json or sarif.
| Finding | Severity | Meaning |
|---|---|---|
SF-OBJ-PERM-001 | High, Medium or Low | A profile or permission set grants Modify All or View All Records on an object. |
SF-FIELD-PERM-001 | High or Medium | Edit (High) or Read (Medium) on a field named like personal data: SSN, date of birth, bank account, card number, passport and similar. |
SF-PERM-ASSIGN-001 | High | A permission set grants Modify All Data, View All Data, Author Apex or Manage Users and at least one active user holds it. Every holder is listed. |
For SF-OBJ-PERM-001, Modify All is High on customer-data objects or with 10 or more holders (else Medium), and View All is Medium on the same terms (else Low). Any grant no active user holds is Low.
Standard profiles and managed permission sets are skipped. Field values are never read.
See also: org perms, org psg-composition.