Security Overview

Security design for the MVP focuses on least privilege, short-lived credentials, and metadata-only collection.

Metadata only

Collectors are built to describe configuration (objects, fields, automations, packages, security settings). Business-record SOQL against standard CRM objects is blocked in code.

OAuth and tokens

• Salesforce Connected App OAuth with PKCE
• Tokens encrypted at rest with an application key
• Tokens deleted after scan collectors finish
• Service-role database credentials stay server-side

Report access

Reports use high-entropy unguessable tokens and are marked noindex. Do not share a report URL publicly if it contains sensitive org configuration details.

Admin access

Internal lead admin is restricted to authenticated operators and an email allowlist.

Limitations

This is an early MVP. We continue hardening rate limits, monitoring, and formal reviews before broader launch.