vulkro-sf org guest-live
Checks the live org's Experience Cloud sites for what an unauthenticated guest can reach.
vulkro-sf org guest-live --target-org <alias>
vulkro-sf org guest-live -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-GUEST-LIVE-001 | High | A live site lets guests register their own accounts. |
SF-GUEST-LIVE-002 | Medium | A site has an active guest user. |
SF-GUEST-LIVE-003 | Medium | A live site allows Chatter guests. |
SF-GUEST-LIVE-004 | Low | A site's guest user could not be resolved, so its exposure is unknown. It is never reported as clean. |
Salesforce has no readable field for a site's "guest access by default" setting, so that setting is not checked. The command does not browse the site or read records as a guest. An org without Experience Cloud or Sites is not an error: a note goes to stderr.
See also: org perms, breach class map.