Skip to main content

Vulkro for Salesforce

Most Salesforce risk isn’t in the code.

Vulkro checks your code and your org’s settings together, and shows how a visitor to your public site could reach your data.

Start a 14-day trialSee the evidence
High riskProven

Set in SetupChanged with clicks, not commits, so a scan of the code never sees it.

Written in codeA check of the settings never reads it, so it never learns what runs next.

WhoA visitor to your public siteNo login needed
01 · Org settingsMediumGuest access is onYour public site lets visitors in without a login.SF-GUEST-LIVE-002
02 · Org settingsMediumGuests can run internal codeA permission set hands them a class.sf-access-guest-permset-escalation
03 · CodeInfoThe code skips the sharing checkIt never asks who is looking.apex-without-sharing-class-info
04 · CodeMediumAny customer’s invoicesThe visitor picks the account to read.apex-crud-fls-gap-exposed-method
What they getYour customers’ bank detailssf-guest-meta-sensitive-field-read
Vulkro, reading both

One path from a stranger to bank details. Vulkro flags the root cause: one class, one change.

01The evidence

Every step comes with its proof.

Open any step to see the exact setting or line of code behind it, then fix the one place that closes the whole path.

Recent Salesforce attacks

WhoGuest user

Anyone on the internet is this user.

The customer site is live and lets people in without a login. Salesforce serves every one of them as the same guest user, so whatever it can reach, a stranger can reach.

Read fromSite settingsLive org

CheckSF-GUEST-LIVE-002

Evidencesites/CustomerPortal.site-meta.xml
<CustomSite>  <active>true</active>  <guestProfile>Customer Portal Profile</guestProfile>  <siteType>ChatterNetwork</siteType></CustomSite>
High riskProvenFix first

Make the invoice code respect sharing and field access. One change in one class closes all five steps.with sharing · WITH USER_MODE

02What it checks

Your code and your org, read as one.

814 checks across both halves (vulkro-sf 0.34.1), joined into the paths an attacker would take.

The full check catalogue

In your code

642checks on code and project files

  • Server codeApex classes and triggers
  • Pages and componentsLWC, Aura, Visualforce
  • AutomationFlows
  • AI agent actionsAgentforce
  • AI responsesEinstein and LLM output
  • Project settingsMetadata

In your org

172checks on the live org’s settings

JoinedWho has access, what they are granted, what that runs, and what it reaches: one attack path, not two lists.
  • Read-only. It never changes the org and never deploys.
  • Reads settings and definitions, never your business records.
  • Your code is scanned on your machine. No AI in detection.

Checks on the live org are part of Pro and of Vulkro Cloud.

03For ISVs

Catch Security Review issues before you submit.

The AgentExchange (formerly AppExchange) Security Review finds problems after you submit. Vulkro checks the same areas while you build.

Security Review, in depthAgentExchange (formerly AppExchange) Security Review checklist
Save $999
Salesforce charges $999 for every review attempt on a paid solution, the first one included (Salesforce). Each failed round you avoid is one fee you keep.
Save weeks
A review typically takes four to five weeks, in Salesforce’s words. Every fix and resubmit starts that wait again.
Security Review readiness · acme-billingGaps in 3 of 6
  • SF-ASRR-001Authorization: CRUD, FLS and sharingData read with no access check apex-crud-fls-unenforced-statementGap
  • SF-ASRR-002Input validation and output encodingSearch text built into a query apex-taint-soql-injectionGap
  • SF-ASRR-003Secrets and credential handlingReady
  • SF-ASRR-004External communication and integrationsReady
  • SF-ASRR-005CryptographyReady
  • SF-ASRR-006Logging, error handling and sensitive dataCustomer records written to the browser console lwc-console-log-record-dataGap
The readiness checklist

The fee and the timing are Salesforce’s, not Vulkro’s. The readiness checklist, the report for the reviewer and the CI gate are all part of Salesforce Pro.

04The product

See it in the product.

Vulkro Cloud: the shared workspace for your team’s orgs, set up for you with a 14-day trial. The same findings show up wherever you work.

Vulkro Cloud
How a visitor to your public site would reach your contacts, step by step.

05Further reading

Salesforce security, in more depth.

See who can reach your Salesforce data.

Start a 14-day trialBook a 20-minute review