Dependencies and SCA

These checks match installed managed packages, JavaScript inside static resources and declared dependencies against offline advisory data bundled with the scanner.

vulkro-sf sca ./force-app
vulkro-sf update          # refresh the advisory data

sca reads sfdx-project.json (packageDirectories[].dependencies) and *.installedPackage-meta.xml. Nothing leaves your machine. Exit codes: 0 no findings, 1 findings, 2 error.

Dependency checks (`sca`)

Rule ID	What it finds	Fix
SF-SCA-001	An installed or declared managed package whose version is covered by an advisory.	Upgrade to the fixed version. If none exists, restrict the package's profiles and permission sets until one ships.
SF-SCA-002	A managed package in the built-in end-of-life table.	Move to a supported version or successor.
SF-SCA-003	A known-vulnerable JavaScript library (such as jQuery, Bootstrap, Moment or CryptoJS) inside a static resource. Matched by content, so renamed bundles are caught.	Replace the library, rebuild the resource and redeploy.
SF-SCA-004	A managed-package dependency declared with no pinned version.	Pin an exact version and re-scan.

Posture checks (`scan`)

Rule ID	What it finds	Fix
SF-THREAT-API-EOL-001	A component whose `apiVersion` is below the floor, so it misses newer platform security defaults.	Raise `apiVersion` and retest.
SF-THREAT-CERT-EXPIRED-001	A self-signed certificate that has expired.	Rotate it and update every integration that uses it.
SF-THREAT-CERT-EXPIRED-002	A self-signed certificate that expires within 30 days.	Schedule the rotation now.

Set your own API version floor with VULKRO_SF_API_VERSION_FLOOR:

VULKRO_SF_API_VERSION_FLOOR=59.0 vulkro-sf scan ./force-app

Dependency checks (sca)​

Posture checks (scan)​

Dependency checks (`sca`)

Posture checks (`scan`)