Install Vulkro for Salesforce

Vulkro for Salesforce is a single binary named vulkro-sf. It is a sibling of the general vulkro scanner and shares the same engine, release feed, and SHA-256 verification. The two are independent, so install both side by side if you scan Salesforce and non-Salesforce code on one machine.

One-line install (macOS, Linux)

curl -fsSL https://dist.vulkro.com/install-sf.sh | bash

On Windows, use the PowerShell installer instead (see Windows below).

The installer:

1. Detects your OS and architecture.
2. Downloads the matching vulkro-sf binary from the Vulkro release feed.
3. Verifies the SHA-256 checksum against the published .sha256 file.
4. Installs to /usr/local/bin/vulkro-sf, or ~/.local/bin if /usr/local/bin is not writable.

Confirm the install:

vulkro-sf --version
vulkro-sf --help

Configurable installer

The installer accepts flags and environment overrides:

# Pin a specific tag.
curl -fsSL https://dist.vulkro.com/install-sf.sh | bash -s -- --version v0.5.2

# Change the install destination.
curl -fsSL https://dist.vulkro.com/install-sf.sh | bash -s -- --bin-dir ~/.local/bin

# Use an alternate CDN (air-gapped mirror, etc.).
VULKRO_CDN=https://mirror.example.com curl -fsSL https://mirror.example.com/install-sf.sh | bash

Environment overrides: VULKRO_SF_VERSION, VULKRO_SF_BIN_DIR, VULKRO_CDN. The script falls back to VULKRO_VERSION and VULKRO_BIN_DIR, so settings you already share with the general installer keep working.

Windows

The Windows vulkro-sf binary runs under PowerShell and inside WSL. Run the PowerShell installer:

irm https://dist.vulkro.com/install-sf.ps1 | iex

It downloads the latest signed vulkro-sf.exe, verifies its SHA-256 checksum, installs it to %USERPROFILE%\.local\bin, and adds that directory to your user PATH. Confirm the install in a new PowerShell window:

vulkro-sf --version

The same environment overrides apply (VULKRO_SF_VERSION, VULKRO_SF_BIN_DIR, VULKRO_CDN), plus the PowerShell parameters -Version and -BinDir. Inside WSL, use the macOS/Linux one-liner above instead.

From source

To track detectors on the unreleased feature branch, or to build air-gapped, install from a repo checkout:

cargo install --path crates/vulkro-sf

This produces the same single binary with no runtime dependencies as the published release.

Optional: Salesforce CLI for the live-org connector

vulkro-sf scans local SFDX source with no Salesforce CLI installed. You only need the sf CLI for the optional vulkro-sf org subcommands (status, perms, packages), which read live org metadata through your existing sf login.

# macOS:
brew install salesforce-cli

# Linux / Windows / macOS:
npm install -g @salesforce/cli

Then authenticate the org once. The sf CLI stores the OAuth token in its own credential store on your laptop, not in Vulkro.

sf org login web --alias my-prod

If sf is missing when you run a vulkro-sf org command, the error prints the exact brew install or npm install -g command to fix it.

Privacy: what the org connector reads

The live-org subcommands read metadata only, through the Salesforce Metadata API and Tooling API. They issue no SOQL or Bulk queries against your business records.

What vulkro-sf org reads

• Profiles and Permission Sets (including assignments).
• SecuritySettings: session timeout, clickjack, CSRF, HTTPS, password policy, login IP ranges.
• Sharing rules and Org-wide defaults.
• Connected Apps and their OAuth scopes.
• Named Credentials and External Credentials.
• Flow definitions and process automation.
• GenAiFunction declarations (Agentforce actions) and target Apex classes.
• Installed packages (managed and unmanaged) with version and license.
• Static Resources (for hardcoded API key scanning).

What vulkro-sf org does NOT read

• No customer records.
• No Accounts, Opportunities, Leads, Cases, Contacts, custom-object rows.
• No file attachments, ContentVersions, ContentDocuments.
• No SOQL SELECT against any sObject that contains business data.
• No Bulk API queries.

Where the OAuth token lives

In the official sf CLI credential store on your laptop. The connector asks sf to fetch the metadata, and sf returns it. Vulkro never sees, stores, or transmits the access token. To revoke org access, use Salesforce Setup, the same way you would for the sf CLI itself.

Commands

Command	What it does	Live org needed?
vulkro-sf scan [PATH]	Run the engine detectors over an SFDX project or retrieved metadata	no
vulkro-sf scan --metadata-only [PATH]	Skip project detection and the Apex requirement	no
vulkro-sf antipatterns [PATH]	Salesforce Well-Architected anti-patterns (AP-001 to AP-014)	no
vulkro-sf appexchange-report [PATH] -o report.html	AppExchange Security Review readiness HTML	no
vulkro-sf org status --target-org <alias>	Verify connectivity and print org identity	yes
vulkro-sf org perms --target-org <alias>	Permission-set / profile over-privilege + dormant admins	yes
vulkro-sf org packages --target-org <alias>	Installed package risk (pre-release / unmanaged)	yes
vulkro-sf update	Self-upgrade the binary and refresh the signed CVE data	no

Exit codes follow the standard contract: 0 for success with no findings, 1 for findings reported, 2 for error.

Staying up to date

vulkro-sf update upgrades the binary from the vulkro-sf release channel and refreshes the signed CVE / rule / compliance data. Run it now and then, or wire it into a scheduled job. It is the only command that touches the release feed: a plain vulkro-sf scan makes no release-feed request and shows no update notice. See vulkro-sf update for the full flag set, air-gapped bundle apply, and CI usage. Suppress the upgrade prompt with --no-version-check or VULKRO_NO_UPDATE_CHECK=1.

Where to go next

• Methodology - the master reference for what a safe Salesforce app should be, plus Vulkro's detector-by-detector coverage matrix.
• AppExchange readiness report - what vulkro-sf appexchange-report produces and how to read it.
• AppExchange readiness - the buyer-facing overview of how AppExchange submitters use the product.
• Vulkro for Salesforce - the per-engagement audit pattern.