vulkro-sf org named-credentials
Every live-org command (vulkro-sf org ...) is part of Pro: Live-org audit (sf-live-org), permissions, session, MFA, sharing, packages and trust, read from the org itself. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.
Audits live Named Credentials (SF-NC-LIVE-001 / -002 / -003).
Named Credentials are the org's outbound callout surface: they hold the endpoint and the authentication chain that Apex uses to reach an external system. This command reads their current configuration from the org rather than the metadata in a repository, so it catches drift applied directly in Setup.
Synopsis
vulkro-sf org named-credentials --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | enum | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
NamedCredential rows from the Tooling API: Id, DeveloperName,
Endpoint, PrincipalType, AuthProvider.DeveloperName,
CalloutOptionsAllowMergeFieldsInBody, and
CalloutOptionsAllowMergeFieldsInHeader.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-NC-LIVE-001 | High | Endpoint starts with http://: a cleartext callout. Signal named-credential-live-cleartext-endpoint. |
SF-NC-LIVE-002 | Medium | PrincipalType = 'Anonymous' paired with a non-null auth provider. An anonymous principal is supposed to negotiate at runtime; pairing it with an auth provider suggests a credential is baked in somewhere along the chain. Signal named-credential-live-anonymous-with-auth-provider. |
SF-NC-LIVE-003 | Low | CalloutOptionsAllowMergeFieldsInBody = true. Mirrors the metadata-side rule, applied to live config. Signal named-credential-live-merge-fields-in-body-enabled. |
Examples
vulkro-sf org named-credentials --target-org my-prod
vulkro-sf org named-credentials -o my-prod --format json > named-credentials.json
Exit codes
0- no findings.1- posture findings reported.2- error.
These follow the org command-family contract printed by
vulkro-sf org --help.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. The audit reads Named Credential
configuration only. Secret values are not read and are not printed:
the rules reason about endpoint scheme, principal type, and callout
options, not about the credential itself.
Findings are static posture signals, not runtime-validated
exploits: SF-NC-LIVE-001 reports that an endpoint is configured as
plain HTTP, it does not prove that traffic was intercepted. A run with
no findings does not certify the org's callout surface clean.
Where to go next
- Named Credentials (detector) - the source-format side of the same rule family.
- vulkro-sf org connected-apps - inbound OAuth posture.
- vulkro-sf org domain - the other cleartext-transport surface in the org.