vulkro-sf org domain
Every live-org command (vulkro-sf org ...) is part of Pro: Live-org audit (sf-live-org), permissions, session, MFA, sharing, packages and trust, read from the org itself. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.
Audits MyDomain SSL posture (SF-DOMAIN-001 / -002).
MyDomain is where session cookies and login submissions are served from. A domain row that still permits plain HTTP puts those on the network in cleartext, and a half-completed custom-domain cutover leaves two URL shapes serving the same org.
Synopsis
vulkro-sf org domain --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | enum | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
Domain rows from the Tooling API: Id, Domain, HttpsOption,
DomainType.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-DOMAIN-001 | High | A domain whose HttpsOption allows plain HTTP (Without_HTTPS_Always_Redirect or Allow_HTTP_in_Sandbox). Signal domain-allows-http. |
SF-DOMAIN-002 | Medium | Both Standard and CustomDomain row types are present, signalling a MyDomain rollout that is still mid-flight: the custom-domain switch is partly cut over but the standard MyDomain URLs still serve. Emitted once at project scope, listing the standard domains that still serve. Signal domain-mydomain-partial-rollout. |
Examples
vulkro-sf org domain --target-org my-prod
vulkro-sf org domain -o my-prod --format json > domain.json
Exit codes
0- no findings.1- posture findings reported.2- error.
These follow the org command-family contract printed by
vulkro-sf org --help.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. The audit reads the org's domain
configuration rows. It does not make an HTTP or HTTPS request to
any of those domains, does not fetch a certificate, and does not test
the TLS handshake.
That is the honest limit: SF-DOMAIN-001 reports that the org's
configuration permits plain HTTP, not that a cleartext request was
observed. A run with no findings does not certify the org's transport
posture.
Where to go next
- vulkro-sf org named-credentials - outbound cleartext callout endpoints.
- vulkro-sf org health-check - the Salesforce-computed baseline score.