Matching records
Salesforce-reported aggregate counts across three guest-readable objects.
Introducing OrgRecon
Salesforce Experience Cloud security: Find guest-user exposure.
OrgRecon is an owner-authorized Salesforce security scanner that discovers public Experience Cloud surfaces, proves what anonymous users can access, and turns deterministic evidence into clear remediation.
- Verified owners only
- Approved hosts only
- No Salesforce record contents retained
Findings summary
A conclusion first. Technical depth when you need it.
Open findings
Three confirmed guest exposures and six external posture findings.
Sensitive categories
Name, email, phone, address, organization, support case, subject, and status.
Report evidence
See the finding. Follow the proof.
Live dashboard component preview
This preview is rendered by the same React component used in the authenticated OrgRecon dashboard, using a sanitized Northstar Partner Portal canonical demo report.
External posture
Six public controls. One calm review path.
1 / 6
Low: CAA policy is not published.
The authoritative DNS query completed with no CAA records. This reduces control over which certificate authorities may issue for the domain.
- CAA records
- 0
- Query
- Complete
- Boundary
- No certificate event inferred
{ "check": "dns.missing_caa", "query_type": "CAA", "record_count": 0, "query_completed": true }Medium: TLS 1.0 is supported.
A bounded handshake offering TLS 1.0 completed successfully on the public Salesforce host.
- Protocol
- 1.0
- Handshake
- Complete
- Boundary
- No application exploit inferred
{ "check": "tls.deprecated_protocol_supported", "offered": "TLS 1.0 only", "negotiated": "TLS 1.0", "handshake": "completed" }Medium: Strict-Transport-Security is missing.
The final HTTPS response did not include the HSTS header needed to instruct browsers to require secure transport.
- Header present
- 0
- HTTP status
- 200
- Boundary
- Control owner not inferred
{ "check": "web.missing_strict_transport_security", "method": "GET", "status": 200, "header": "not_present" }Low: DMARC is in monitoring mode.
The public DMARC policy is valid but uses an effective policy of none, so receivers are not asked to quarantine or reject failures.
- Policy
- none
- Record
- Valid
- Boundary
- Reporting addresses withheld
{ "check": "mail.dmarc_monitoring", "effective_policy": "none", "test_mode": false, "record_valid": true }Medium: A configuration-like path responded publicly.
A bounded anonymous request to /config.json returned non-HTML content. The response body was classified and discarded.
- HTTP status
- 200
- Observed size
- 1,284 B
- Boundary
- File contents not retained
{ "check": "web.public_config_file_detected", "status": 200, "classification": "non_html", "body_bytes": 1284, "content_retained": false }High: Potential subdomain takeover: Heroku.
Public DNS and the provider response matched an exact unclaimed-service signature. OrgRecon did not attempt to claim or exploit the service.
- Signature
- Exact
- Claim attempted
- No
- Boundary
- claim_attempted=false
{ "check": "dns.dangling_service_binding", "provider": "heroku", "classification": "exact_unclaimed_signature", "marker": "no such app", "claim_attempted": false }Evidence-bound assistant
Ask AI about the selected finding.
Selected finding · Customer_Profile__c
How should I remediate anonymous access to Customer_Profile__c?
OrgRecon confirmed that anonymous Salesforce responses returned records and value-present sensitive fields for Customer_Profile__c.
- Open the Experience Cloud site’s Guest User Profile.
- Review object Read access, field-level access, sharing rules, and exposed Apex paths.
- Publish the change and rescan until the request is denied or no records are returned.
About Me
“Security and platform teams shouldn't have to rely on guesswork.”
Founder and builder
Nir Alon
I’m Nir Alon, founder of OrgRecon. As a security engineer with years spent securing SaaS platforms and backends at cybersecurity startups, I built OrgRecon to answer one critical question: What can an anonymous guest actually access?
Security and platform teams shouldn't have to rely on guesswork. OrgRecon gives you verifiable proof of your exposure using an approach that is strictly owner-authorized, privacy-aware, and built to discard raw response data automatically.
Frequently Asked Questions
Straight answers before an assessment starts.
What does OrgRecon evaluate?
OrgRecon evaluates approved public Salesforce Experience Cloud surfaces to determine what an anonymous guest can reach. It also records bounded public internet posture evidence, such as DNS, TLS, and HTTP control observations.
Why is owner authorization required?
Assessments are limited to verified owners and explicitly approved hosts. That keeps discovery and validation within a clear, accountable scope.
What data does OrgRecon retain?
OrgRecon retains normalized evidence such as counts, schema, presence, and provenance. Salesforce record contents, identifiers, tokens, cookies, and raw response bodies are discarded.
How does OrgRecon prove a finding?
OrgRecon uses bounded, deterministic requests and records the observable result. Reports connect each owner-facing conclusion to its schema, privacy boundary, provenance, and normalized evidence.
Does OrgRecon change my Salesforce configuration?
No. OrgRecon observes and reports evidence; it does not change Salesforce access controls or configuration. The owner reviews the proof, makes the remediation, and can assess again to verify the result.
See the proof
Know what guests can access before they do.
Follow an illustrative exposure from anonymous observation to remediation—or create an account for an owner-authorized assessment.