vulkro-sf org domain
Audits MyDomain SSL posture (SF-DOMAIN-001 / -002).
MyDomain is where session cookies and login submissions are served from. A domain row that still permits plain HTTP puts those on the network in cleartext, and a half-completed custom-domain cutover leaves two URL shapes serving the same org.
Synopsis
vulkro-sf org domain --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | enum | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
Domain rows from the Tooling API: Id, Domain, HttpsOption,
DomainType.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-DOMAIN-001 | High | A domain whose HttpsOption allows plain HTTP (Without_HTTPS_Always_Redirect or Allow_HTTP_in_Sandbox). Signal domain-allows-http. |
SF-DOMAIN-002 | Medium | Both Standard and CustomDomain row types are present, signalling a MyDomain rollout that is still mid-flight: the custom-domain switch is partly cut over but the standard MyDomain URLs still serve. Emitted once at project scope, listing the standard domains that still serve. Signal domain-mydomain-partial-rollout. |
Examples
vulkro-sf org domain --target-org my-prod
vulkro-sf org domain -o my-prod --format json > domain.json
Exit codes
0- no findings.1- posture findings reported.2- error.
These follow the org command-family contract printed by
vulkro-sf org --help.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. The audit reads the org's domain
configuration rows. It does not make an HTTP or HTTPS request to
any of those domains, does not fetch a certificate, and does not test
the TLS handshake.
That is the honest limit: SF-DOMAIN-001 reports that the org's
configuration permits plain HTTP, not that a cleartext request was
observed. A run with no findings does not certify the org's transport
posture.
Where to go next
- vulkro-sf org named-credentials - outbound cleartext callout endpoints.
- vulkro-sf org health-check - the Salesforce-computed baseline score.