Open Source.
All posts.
Free Salesforce Event Monitoring: Build a Security Baseline from EventLogFile Without Shield
Salesforce gives Enterprise, Unlimited and Performance orgs free EventLogFile logs, but only for a day. How to capture them into a baseline without Shield.
Salesforce Guest User Exposure: How sf-audit Grades It by Real Reachability
sf-audit now grades Salesforce guest user exposure by real UI API reachability, not just the sharing model, and adds six new external-facing security checks.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two open-source sf CLI plugins audit Salesforce security from the terminal. One is opinionated and broad, the other configurable and focused. How to pick.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.