`vulkro-sf recert`

Builds an access recertification worksheet: one row per high-privilege grant, for an access owner to re-attest or revoke.

vulkro-sf recert .
vulkro-sf recert . --format json > recert.json
VULKRO_SF_RECERT_STALE_DAYS=30 vulkro-sf recert .

It scans the package and lists every high-privilege grant the access checks found: god-permission bloat, privilege-escalation combinations, custom-permission gates on broad sets, sensitive fields readable or editable by a broad profile, FLS over-grants, stale active accounts, and grants left on deactivated users. Each row (SF-ACCESS-RECERT-001) carries the grant subject, a risk weight and a recert-due flag. This supports the access recertification control in SOX, ISO 27001 and SOC 2.

For stale and orphaned accounts, place a User export (CSV or JSON with IsActive and LastLoginDate) and a PermissionSetAssignment export anywhere under the path. No org connection is made.

Flag or variable	What it does
`[PATH]`	SFDX project or retrieved metadata. Default `.`.
`--format <table\|json>`	Output format. Default `table`.
`VULKRO_SF_RECERT_STALE_DAYS`	Days without a login before an active account counts as stale. Default `90`.

Exit codes

Code	Meaning
`0`	No high-privilege grants to certify.
`1`	Grants listed: the worksheet has rows to attest.
`2`	Error (unscannable path, unknown `--format`).

Exit codes​

Exit codes