Sf Plugin.
All posts.
Threat Modelling a Salesforce Org: STRIDE, LINDDUN, MITRE ATT&CK and Abuse Cases in sf-audit
A Salesforce audit lists settings. A threat model asks who could abuse them. How to apply STRIDE, LINDDUN and ATT&CK to an org, and what it changed in sf-audit.
sf-audit 1.17: 14 Salesforce Security Checks for Inbound Email, Platform Events, Data Cloud and Package Installs
sf-audit 1.17 adds 14 read-only checks and two critical attack chains for inbound email, Platform Events, Data Cloud, package installs and Apex system mode.
sf-audit vs sf-cli-security-audit: Two Salesforce Security CLIs Compared
Two sf CLI plugins audit Salesforce security from the terminal. One is opinionated, broad and open source; the other configurable and focused. How to pick.
sf-audit v1.0: New Checks, Configurable Scoring, and Externalized Queries
The audit plugin has grown from 22 checks to 23, added four new threat surfaces, and gained a fully configurable scoring model. Here is what changed and why it matters.
Catch Salesforce Security Gaps in One Command
Most Salesforce orgs are carrying security debt they don't know about. This plugin surfaces it in a single command.
How We Built a Native sf Plugin for Salesforce Security
We had a working Python script. Here is why we rewrote it as a native sf plugin, and the design decisions that made 22 parallel security checks practical.