vulkro-sf org guest-live
Audits Experience Cloud guest-user posture on the live org
(SF-GUEST-LIVE-001 / -002 / -003).
Guest-user configuration on a live community is the configuration shape behind the published Experience Cloud breach class: an unauthenticated visitor reaching records that were never meant to be public. This command reads the sites and networks that are actually serving, rather than the metadata that may or may not be deployed.
Synopsis
vulkro-sf org guest-live --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | enum | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
Networkrows, includingStatus,OptionsAllowGuestSelfRegistration, andOptionsAllowChatterGuests. Only networks whoseStatusisLiveare considered.Siterows:Id,Name,GuestUserId,Subdomain,UrlPathPrefix,GuestUserAccessByDefault.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-GUEST-LIVE-001 | High | A Live network with "Allow guest self-registration" on, so any visitor can create their own user account. Combined with a permissive guest profile this is the standard Experience Cloud data-exfiltration path. Signal network-live-guest-self-registration-enabled. |
SF-GUEST-LIVE-002 | High | A Site where guest access is the default (GuestUserAccessByDefault). Signal site-live-guest-access-default. |
SF-GUEST-LIVE-003 | Medium | A Live network with "Allow Chatter guests" on, widening the collaboration surface to users without an authenticated account. Signal network-live-chatter-guests-enabled. |
Each finding carries the Setup path to remediate it.
Examples
vulkro-sf org guest-live --target-org my-prod
vulkro-sf org guest-live -o my-prod --format json > guest-live.json
Exit codes
0- no findings.1- posture findings reported.2- error.
These follow the org command-family contract printed by
vulkro-sf org --help.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. Only site and network configuration is read.
The command does not browse the community, does not request any
public URL, and does not attempt to enumerate records as a guest user.
That is the honest limit of this audit: it reports that a configuration allows guest self-registration or default guest access, not that any specific record is currently exposed. Confirming actual exposure is a manual review step. A run with no findings does not certify a community safe.
Where to go next
- vulkro-sf org perms - guest-user license profile permissions, the other half of this breach class.
- Detection deep-dive: breach class map - the public incidents these rules trace back to.