Profiles and Permission Sets

These checks cover *.profile-meta.xml, *.permissionset-meta.xml, *.permissionsetgroup-meta.xml, *.samlssoconfig-meta.xml and *.loginFlow-meta.xml, plus user assignments when you audit a live org.

vulkro-sf scan ./force-app
vulkro-sf org perms -o <alias>   # live org: SF-PERM-001, SF-PERM-002

Checks

Check	What it finds
Standard profile clone over-privilege	A clone of System Administrator, Standard User or Marketing User with `ModifyAllData` and `ManageUsers`. Use a custom profile with only what is needed.
Custom profile over-privilege	A custom profile with `ModifyAllData`, `ManageUsers` or `AuthorApex`. `AuthorApex` lets a user bypass every CRUD/FLS rule in code.
Permission set over-privilege (`sf-access-permset-bloat`)	The same flags on a permission set, the surface most often granted ad hoc and never revoked.
Permission set group aggregation (`psg-composition-grants-effective-modify-all-data`)	A group whose members together are admin-equivalent, such as `ViewAllData` + `ManageUsers`.
Dormant admin (`SF-PERM-002`, live org)	A user with `ModifyAllData` (via profile, permission set or group) whose last login is more than 90 days ago.
Over-privileged profile or permission set (`SF-PERM-001`, live org)	Over-privilege found in the live org.
Guest license elevation	A `Guest License` profile granting `read` or `viewAllRecords` on an object the PII map marks tier-1 or tier-2. Every record becomes readable by anonymous visitors.
Weak SAML signature (`saml-weak-signature-algorithm`)	A `SamlSsoConfig` with a SHA-1 request signature method. Use `RSA-SHA256`.
Login Flow inventory (`loginflow-active`)	Each active custom Login Flow, so its body can be reviewed. Not a finding by itself.

Example

Non-compliant: a custom profile with ModifyAllData and ManageUsers.

<Profile xmlns="http://soap.sforce.com/2006/04/metadata">
    <custom>true</custom>
    <userLicense>Salesforce</userLicense>
    <userPermissions>
        <name>ModifyAllData</name>
        <enabled>true</enabled>
    </userPermissions>
    <userPermissions>
        <name>ManageUsers</name>
        <enabled>true</enabled>
    </userPermissions>
</Profile>

Compliant: a permission set with only ViewAllData, assigned to an active user, is not flagged.

Metadata findings are suppressed with a fingerprint in .vulkroignore, not with inline comments.

Checks​

Example​

Checks

Example