vulkro-sf org named-credentials
Audits live Named Credentials (SF-NC-LIVE-001 / -002 / -003).
Named Credentials are the org's outbound callout surface: they hold the endpoint and the authentication chain that Apex uses to reach an external system. This command reads their current configuration from the org rather than the metadata in a repository, so it catches drift applied directly in Setup.
Synopsis
vulkro-sf org named-credentials --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | enum | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
NamedCredential rows from the Tooling API: Id, DeveloperName,
Endpoint, PrincipalType, AuthProvider.DeveloperName,
CalloutOptionsAllowMergeFieldsInBody, and
CalloutOptionsAllowMergeFieldsInHeader.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-NC-LIVE-001 | High | Endpoint starts with http://: a cleartext callout. Signal named-credential-live-cleartext-endpoint. |
SF-NC-LIVE-002 | Medium | PrincipalType = 'Anonymous' paired with a non-null auth provider. An anonymous principal is supposed to negotiate at runtime; pairing it with an auth provider suggests a credential is baked in somewhere along the chain. Signal named-credential-live-anonymous-with-auth-provider. |
SF-NC-LIVE-003 | Low | CalloutOptionsAllowMergeFieldsInBody = true. Mirrors the metadata-side rule, applied to live config. Signal named-credential-live-merge-fields-in-body-enabled. |
Examples
vulkro-sf org named-credentials --target-org my-prod
vulkro-sf org named-credentials -o my-prod --format json > named-credentials.json
Exit codes
0- no findings.1- posture findings reported.2- error.
These follow the org command-family contract printed by
vulkro-sf org --help.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. The audit reads Named Credential
configuration only. Secret values are not read and are not printed:
the rules reason about endpoint scheme, principal type, and callout
options, not about the credential itself.
Findings are static posture signals, not runtime-validated
exploits: SF-NC-LIVE-001 reports that an endpoint is configured as
plain HTTP, it does not prove that traffic was intercepted. A run with
no findings does not certify the org's callout surface clean.
Where to go next
- Named Credentials (detector) - the source-format side of the same rule family.
- vulkro-sf org connected-apps - inbound OAuth posture.
- vulkro-sf org domain - the other cleartext-transport surface in the org.