Tools.
Things built while writing the rest of this site. Everything here is read-only against your org, runs locally, and is free. Four of them install in one line.
sf-audit
Read-only security audit for a Salesforce org. 88 checks across ten domains, correlated into attack chains rather than listed as a flat set, with an A to F grade and mapping to OWASP, SOC 2, ISO 27001 and NZISM.
Most audit output is a list of findings nobody can prioritise. This one answers which findings combine into a path an attacker could actually walk.
sf plugins install @cclabsnz/sf-auditsf-orgintel
Works out how an org actually behaves: its processes, its domains, and the cross-object couplings nobody documented. Computed entirely on your machine from metadata and behavioural data.
Inheriting an org means inheriting decisions nobody recorded. This reconstructs them from what the org does rather than what the documentation claims.
sf plugins install @cclabsnz/sf-orgintelsfelf-triage
Forensic triage for downloaded EventLogFile CSVs. Produces a per-IP verdict of benign scanner, suspicious, or likely abuse. Zero network egress: it never talks to your org, or to anything else.
When you are looking at log data during an incident, the last thing you want is a tool that phones home. This one reads local CSVs and nothing more.
npm install -g sfelf-triagesf-flow-apex-converter
Analyses Flows for governor limit problems and converts the offending ones into bulkified Apex. It finds the usual anti-patterns, SOQL and DML inside loops, and generates a class that does the same work in bulk.
A Flow that works fine on one record and dies on two hundred is a rewrite nobody scheduled. This does the mechanical part of that rewrite so the argument is about the output rather than the effort.
npm install -g @cclabsnz/sf-flow-apex-converterraci-workshop
Real-time collaborative RACI alignment for delivery teams. Everyone opens the same URL and disagreements surface in the room rather than three weeks later in a status report.
RACI matrices usually get filled in by one person and agreed by nobody. Doing it live, together, is the entire point.
OPEN THE WORKSHOP →sf-core
The shared platform layer underneath the plugins above: read-only API clients, org context, event log pull, report shell, and versioned IR contracts.
Listed for completeness rather than for installing. You get this as a dependency of the tools above, and it only matters directly if you are building something on the same foundation.