Open Source.
All posts.
sf-audit 1.17: 14 Salesforce Security Checks for Inbound Email, Platform Events, Data Cloud and Package Installs
sf-audit 1.17 adds 14 read-only checks and two critical attack chains for inbound email, Platform Events, Data Cloud, package installs and Apex system mode.
Jev vs Clef vs Laya: Cloudflare's Clef Decision Model Tested on 600 Business Decisions
I ran Cloudflare's new Clef and Clef-flash through the same tests as Jev, Laya and Einstein: 600 decisions plus 7 real failures. Accuracy, speed and cost.
Salesforce Guest User Anomaly Fired: Scanner, Tester, or Data Leaving? Investigate It with sf audit incident
A Salesforce Guest User Anomaly fired. Scanner, tester, or data leaving? How sf audit incident turns the alert into a cited, defensible verdict, offline.
Salesforce Security Audit Tools Compared: Health Check, Code Analyzer, AuraInspector, Org Check and sf-audit
Salesforce Health Check scores settings, not exposure. What Code Analyzer, AuraInspector, Org Check, Security Center and sf-audit each cover, and what to use.
Mocking in Apex: Stub API, HttpCalloutMock and ApexMocks Compared
Four ways to isolate Apex under test, from the built-in callout mocks through to fflib ApexMocks, with what each one costs and the design each one demands.
A Guest IP Got Flagged for Log4j: Scanner or Breach? Triage Salesforce EventLogFile in One Command
A guest Experience Cloud IP is flagged for Log4j exploitation. Scanner or real attacker? How to tell it apart from your EventLogFile logs, in one command.
Which of Your Salesforce Connected Apps Use Less Than They're Granted? Ask Your Own Logs
Static scanners tell you what a connected app was granted, not what it uses. Here is how to measure the over-grant per object from your own EventLogFile.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two sf CLI plugins audit Salesforce security from the terminal. One is opinionated, broad and open source; the other configurable and focused. How to pick.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.