Salesforce security audits fail for a predictable reason: they treat the org as a static system. But users are added, integrations change, consultants come and go, and permission sets accumulate without anyone signing off. These three resources give you a working thread from raw permission metadata to a documented, repeatable audit.
Pick the entry that matches your situation. Profile and permission bloat — start with the Permissions Scanner. OAuth sprawl and dormant refresh tokens — read the Connected Apps guide. A complete quarterly sweep — work the 47-point checklist.
Each tool targets a distinct failure mode in the security audit cluster. They are designed to be used together — but each one stands alone.
Inventory profiles and permission sets, flag over-privileged access, and surface FLS gaps. 100% client-side — no Salesforce credentials required.
Surface stale OAuth tokens, apps installed by departed users, over-permissioned scopes, and the cascading AI risk they enable. Framework, checklist, and revocation playbook.
Work all 47 audit items across user access, permission sets, sharing rules, profile hygiene, API access, OAuth, field-level security, and audit trail. PDF download included.
An Active user that hasn't logged in since last quarter is an attacker-ready credential. It won't trigger unusual login alerts because the pattern is normal, and its permissions haven't been reviewed since the day it was created.
A connected app installed by a contractor in 2022 may still have an active refresh token. When that user's account is compromised — or the contractor's org is breached — your data is still reachable through the token.
Every quick fix — "add this permission set to unblock the user" — leaves behind a small piece of access that no one audits later. After two years, the org has 80 permission sets and no one knows the full access picture.
The Founding Member tier connects FlowPilot to your Salesforce org and runs the permission, OAuth, and validation checks against your actual metadata — not a CSV export.