vulkro-sf org report
Writes one shareable HTML or Markdown security posture report for the live org.
vulkro-sf org report --target-org <alias> -O org-posture.html
vulkro-sf org report -o <alias> --format markdown -O org-posture.md
The report covers over-privilege, session, password, clickjack and CSRF settings, Connected App OAuth settings, installed packages and org complexity. It has the same findings as the Org security posture tab in the local console (vulkro-sf serve).
Flags
| Flag | Meaning |
|---|---|
--target-org, -o <alias> | Org alias or username from sf org login. Required. |
--format <fmt> | html (default) or markdown. |
--output, -O <path> | Write to this file instead of stdout. Note the capital -O. |
Findings are likely-risk signals, not proven exploits, and the report never certifies an org clean.
Exit codes
| Code | Meaning |
|---|---|
0 | No findings, or the org could not be reached (the report says so). |
1 | Findings reported. |
2 | Error: unknown --format, or the file could not be written. |
See also: org status, Live org setup.