vulkro-sf org session
Checks the live org's active sessions for ones that stay valid too long or are too old.
vulkro-sf org session --target-org <alias>
vulkro-sf org session -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-SESSION-LIVE-001 | High | An admin (Modify All Data) has a session valid for more than one day. |
SF-SESSION-LIVE-002 | Medium | Any user has a session valid for more than one day. |
SF-SESSION-LIVE-003 | Low | An active session was created more than 30 days ago. |
A long-lived session lets a stolen session ID keep working after a password change. It reads session details only: no session tokens are read and no session is ended.
See also: org login-history, org mfa.