vulkro-sf org sharing-rules

Checks sharing on the live org's Accounts, Opportunities, Contacts and Leads for access wider than it should be.

vulkro-sf org sharing-rules --target-org <alias>
vulkro-sf org sharing-rules -o <alias> --format json

Finding	Severity	Meaning
SF-SHARING-001	High	A share grants broad write access.
SF-SHARING-002	Medium	A record is manually shared with a portal user.
SF-SHARING-003	Low	A criteria-based share covers many records.

It reads share rows, public groups and record counts, never record values. Custom objects are not covered.

See also: role-hierarchy, org guest-live.