Skip to main content

vulkro-sf org domain

Audits MyDomain SSL posture (SF-DOMAIN-001 / -002).

MyDomain is where session cookies and login submissions are served from. A domain row that still permits plain HTTP puts those on the network in cleartext, and a half-completed custom-domain cutover leaves two URL shapes serving the same org.

Synopsis

vulkro-sf org domain --target-org <alias> [flags]

Flags

FlagTypeDefaultDescription
--target-org, -o <alias>string(required)Target org alias or username, as known to sf org login.
--format <fmt>enumtableOutput format.
--verbose, -vflagoffBump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins).

What gets read

Domain rows from the Tooling API: Id, Domain, HttpsOption, DomainType.

What gets reported

RuleSeverityWhat fires
SF-DOMAIN-001HighA domain whose HttpsOption allows plain HTTP (Without_HTTPS_Always_Redirect or Allow_HTTP_in_Sandbox). Signal domain-allows-http.
SF-DOMAIN-002MediumBoth Standard and CustomDomain row types are present, signalling a MyDomain rollout that is still mid-flight: the custom-domain switch is partly cut over but the standard MyDomain URLs still serve. Emitted once at project scope, listing the standard domains that still serve. Signal domain-mydomain-partial-rollout.

Examples

vulkro-sf org domain --target-org my-prod

vulkro-sf org domain -o my-prod --format json > domain.json

Exit codes

  • 0 - no findings.
  • 1 - posture findings reported.
  • 2 - error.

These follow the org command-family contract printed by vulkro-sf org --help.

Scope and honesty

The org is read locally through your own authenticated sf CLI login; nothing is sent anywhere. The audit reads the org's domain configuration rows. It does not make an HTTP or HTTPS request to any of those domains, does not fetch a certificate, and does not test the TLS handshake.

That is the honest limit: SF-DOMAIN-001 reports that the org's configuration permits plain HTTP, not that a cleartext request was observed. A run with no findings does not certify the org's transport posture.

Where to go next