vulkro-sf org named-credentials

Checks the live org's Named Credentials for cleartext endpoints and risky authentication settings.

vulkro-sf org named-credentials --target-org <alias>
vulkro-sf org named-credentials -o <alias> --format json

Finding	Severity	Meaning
SF-NC-LIVE-001	High	The endpoint starts with http://: callouts go in cleartext.
SF-NC-LIVE-002	Medium	An anonymous principal is paired with an auth provider, which suggests a credential is stored somewhere in the chain.
SF-NC-LIVE-003	Low	Merge fields are allowed in the callout body.

It reads the live settings, so it catches changes made directly in Setup. Secret values are never read or printed.

See also: Named Credentials, org connected-apps.