OrgRecon Information

OrgRecon LLC helps CISOs, security teams, and Salesforce platform owners answer a practical question: who can access what in Salesforce Experience Cloud? Guest Assessment identifies what an unauthenticated public visitor can reach. Authenticated User Assessment (Persona Assessment) uses OAuth authorization from the Salesforce user being tested to observe that user's access across approved routes, runtime actions, Apex REST endpoints, APIs, records, fields, files, and available metadata. Validate everyday access boundaries: can partner support read its own cases while internal notes stay restricted? Are customer files and records isolated between accounts? Can a community member reach administrative endpoints or developer metadata? Salesforce remains the authority for access decisions. OrgRecon records the observed outcome and connects it to evidence so teams can compare actual access with intended policy. Allowed access is not automatically a vulnerability. Assessments are owner-authorized and scoped to approved targets and actions. OrgRecon does not retain raw Salesforce record values, record IDs, tokens, cookies, or response bodies in reports. Evidence-based explanations help teams prioritize remediation and reassess after changes. Results apply to the tested users, actions, and available coverage; they are not a guarantee that every backend vulnerability is absent. Explore Guest and Persona Assessment reports or get started at https://orgrecon.com