Use case · Experience Cloud owners
Know what an anonymous visitor can reach in your org.
Every public Experience Cloud or Salesforce site has a guest user. Vulkro for Salesforce reads the guest profile, the sharing, the Apex and the Flows behind each site, and shows the path from the open internet to your data, with the setting that opened it.
Vulkro for Salesforce · Vulkro Cloud
UserGuest user
Anyone on the internet is this user.
The Customer Portal site is active and serves unauthenticated visitors as its guest user. There is no login between a stranger and everything this user can reach.
<CustomSite><active>true</active><guestProfile>Customer Portal Profile</guestProfile><siteType>ChatterNetwork</siteType></CustomSite>
Break the path at the hop that carries it. Declare with sharing on InvoiceController and query WITH USER_MODE: one change in one class closes all five hops.
01The problem
Guest access is set in many different places
No single Setup page answers what a visitor without a login can read. The answer is the sum of several layers, and each looks harmless alone.
The guest profile
Object and field permissions, and any permission set handed to the guest user, decide what can be read at all.
Sharing
Guest sharing rules, sharing sets and the external org-wide default decide which records are in reach.
Apex that bypasses the profile and sharing
An LWC or Aura method the guest can call, running without sharing and without field checks, reaches data the profile alone would not.
Site settings
Self-registration, guest Chatter, public APIs and file access each widen the surface a little more.
02How Vulkro handles it
What each part of Vulkro does
- Guest checks in the free source scan, such as "Guest can run data-accessing Apex on an LWR site" and "Guest can read a sensitive field"
- Every externally reachable entry point, listed with `entrypoints` (Free)
- An exposure report per site: what the guest reads, the Apex it calls and its sharing mode, the Flows it runs, the top proven paths and a verdict (Pro)
- Live guest posture read from the org through your own sf CLI login: self-registration, guest access by default, Chatter guests (Pro)
- Exposure and Attack Paths sections for every live org
- Scheduled rescans, so a new guest grant shows up in Changes
- Each exposure issue with a key, an owner and a status that closes on rescan
03The workflow
Steps from first scan to fix
- 01Vulkro for Salesforce
List the public surface
List every Aura method, REST resource, Visualforce controller and Flow a visitor could reach, with the sharing keyword on each class and the file that grants the guest access.
- 02Vulkro for Salesforce
Read the exposure report
One verdict per site: exposed, at risk, limited, no guest access or not determined, worst first, with the proof behind each path.
- 03Vulkro for Salesforce
Add the live facts
Point the report at the org to add the status and guest user of each site, and how many records sit behind each readable object. Counts only: no record is read.
- 04Vulkro for Salesforce
Close each path
Every fix is a Setup path or a metadata change. Vulkro never applies one for you.
- 05Vulkro Cloud
Watch for regressions
Scheduled scans catch the next guest grant someone adds in Setup.
04What you get
What you get
- Per site
- What the guest reads, calls and runs, for every Experience Cloud and Salesforce site.
- The cause
- Each path names the profile grant, sharing rule, class or setting that opened it.
- Read-only
- Live facts are COUNT() queries through your own login. No record is read and nothing is changed.
- Shareable
- A summary edition with counts and verdicts only, safe to send outside the team.
- In CI
- The exposure report exits 1 while guest exposure remains, so it can block a deploy.
Questions
Common questions
- Our project has no Experience Cloud site. What do we see?
- A clean guest surface. Guest exposure needs a published site and a guest profile grant, so a project without them reports none, which is the right answer, not a miss.
- Does the scan send our org data anywhere?
- No. Vulkro for Salesforce runs on your machine and reads the org through your own sf CLI login. Live reads are refused under the offline switch.
- What is free and what is Pro?
- The source scan with its guest checks, and the entry-point list, are free. The per-site exposure report and the live-org reads are Pro.