Live-org setup

The vulkro-sf org commands audit a running org (permissions, sessions, MFA, connected apps, packages and more) through your own Salesforce CLI login. They only read: nothing in the org is ever changed.

npm install -g @salesforce/cli          # or: brew install salesforce-cli
sf org login web --alias my-prod        # sandbox: add --instance-url https://<domain>.sandbox.my.salesforce.com
vulkro-sf org status --target-org my-prod
vulkro-sf org report --target-org my-prod -O posture.html

org status checks the connection and prints the org's identity. org report writes one shareable posture report (HTML, or --format markdown).

How it connects

vulkro-sf never handles your Salesforce credentials. It runs sf commands (sf data query, sf project retrieve start, sf api request rest) against the alias you name, so the OAuth token stays in the sf CLI's own store. The analysis runs on your machine and nothing is sent to Vulkro. To revoke access, revoke the Salesforce CLI in Setup, as you would for sf itself.

What it reads

• Profiles, permission sets, permission set groups and their assignments.
• Security, session, password and MFA settings; sharing rules and org-wide defaults.
• Connected apps, External Client Apps, OAuth token usage, named and external credentials.
• Installed packages, sites and Experience Cloud guest settings.
• Users (for dormant and integration accounts), LoginHistory, SetupAuditTrail and event log files.

It does not read the contents of your business records (accounts, contacts, cases and so on). A few checks count records with SELECT COUNT() and read no rows.

Permissions the user needs

Log in to sf as a user with API Enabled and View Setup and Configuration. The event-monitoring checks also need View Event Log Files. A read the user cannot make is reported as not covered, never as a clean result.

Main commands

All take -o, --target-org <alias>.

Command	What it audits
org status	Connection and org identity.
org report	One posture report covering identity, settings, connected apps and packages.
org perms / org effective-perms	Over-privileged profiles and permission sets; what users really hold.
org connected-apps / org oauth-risk	OAuth scopes, token use and app risk.
org session / org mfa / org login-history	Sessions, MFA enforcement, login anomalies.
org packages	Installed packages, unverified ones flagged.
org guest-live	Experience Cloud guest-user exposure.

vulkro-sf org --help lists every audit. You can also add live-org facts to a source scan with vulkro-sf scan ./force-app --org my-prod.

Exit codes

0 no findings, 1 posture findings reported (or no licence), 2 error (for example, sf missing or the alias not logged in).

See also: Live-org verification, Source scan vs live-org scan