Your first scan

vulkro-sf scan checks a Salesforce project on disk for security findings. No live org is needed.

vulkro-sf login            # once per machine (needs an active trial or Pro)
vulkro-sf scan ./force-app

Point it at an SFDX project (a folder with sfdx-project.json) or a retrieved metadata folder. A path inside a project widens to the project root; --subtree scans only that path.

What you see

Vulkro for Salesforce - scanned force-app
6 finding(s), health score 85/100 (higher is safer)
Findings: 1 HIGH  5 LOW

Fix these first (6 highest-risk of 6 finding(s)):
  1. HIGH  Hardcoded credential in Apex  [risk 55]
     force-app/main/default/classes/VulnApex.cls:8
     HIGH severity, likely exploitable · id provider-format-match:430e95ed17244acf
  ...

• Health score: 0 to 100, higher is safer.
• Fix these first: findings ranked by risk, each with file, line and a finding id (rule:hash).
• Proven / unproven: the details below say whether Vulkro traced the finding end to end or only matched a pattern, who can reach the code, the fix, and how to verify it.
• Coverage: files the scan could not read are listed, with how to fix it.

Useful flags

Flag	What it does
--format <fmt>	table (default), json, sarif or ocsf. Write to a file with >.
--min-confidence <level>	high, medium (default) or low (shows everything).
--metadata-only	Scan metadata without Apex (a retrieved org snapshot).
--gate-vs <ref>	Fail only on findings that are new compared with a git ref.
--org <alias>	Add live-org facts to the attack paths (read only, through sf).
--no-suppress	Show findings hidden by // vulkro:disable comments.

vulkro-sf scan ./force-app --format sarif > findings.sarif

Exit codes

Code	Meaning
0	No findings at or above the confidence floor.
1	Findings reported, or no licence (license_required).
2	Error: bad arguments, unreadable path, internal failure.

See also: CLI reference: scan, Live-org setup, CI/CD integration