Use case · Experience Cloud site owners
See what an anonymous visitor can reach in your org.
Vulkro reads the guest profile, sharing, Apex and Flows behind each public site, and shows the path to your data with the setting that opened it.
01The problem
Guest access is the sum of many settings.
No single Setup page says what a visitor without a login can read. Each layer looks harmless on its own.
- The guest profileObject and field permissions decide what can be read at all.
- SharingGuest sharing rules and defaults decide which records are in reach.
- Code that skips bothAn Apex method a guest can call, running without sharing, reaches what the profile alone would not.
02How Vulkro helps
From the open internet to your data, step by step.
Every path names who can start it, each step through your org and the data at the end, so you close the one step that matters.
- Who can start itA visitor to a public site, with no login.
- Every step it takesFrom the method the visitor can call to the query that skips record sharing.
- What it reachesThe object and fields at the end, with sensitive fields counted.
Shown in Vulkro Cloud, where attack paths are part of every Vulkro Cloud plan. Vulkro for Salesforce reports the top paths for each site in its exposure report. Example org: Acme Production.
03Why it holds up
Precise, and checkable.
- 01Counted, never readLive facts are record counts through your own login. No record is opened and nothing in the org is changed.Read-only
- 02One verdict per siteExposed, at risk, limited, no guest access or not determined, worst first.The exposure report is part of Pro
- 03The cause, not the symptomEach path names the profile grant, sharing rule, class or setting that opened it.Guest checks run in every scan