vulkro-sf org domain
Checks the live org's My Domain settings for domains that allow plain HTTP.
vulkro-sf org domain --target-org <alias>
vulkro-sf org domain -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-DOMAIN-001 | High | A domain's HTTPS option allows plain HTTP, so session cookies and logins can travel in cleartext. |
SF-DOMAIN-002 | Medium | Standard and custom domains both still serve the org: the My Domain rollout is half done. Reported once. |
It reads domain settings only. It does not connect to the domains or test TLS, so SF-DOMAIN-001 means the setting allows HTTP, not that cleartext traffic was seen.
See also: org named-credentials, org health-check.