What it requires. Flows must not hardcode absolute URLs in assignments, formulas, or action inputs. Org URLs change between environments and on My Domain changes; external endpoints belong in Named Credentials or configuration.
Why it matters. A hardcoded URL points at exactly one environment. Sandbox refreshes and My Domain renames silently break links, redirects, and callouts, and the failure surfaces in production rather than in review.
How to fix it. Build org URLs from $Api merge fields or formula resources; hold external endpoints in Named Credentials or Custom Metadata.
Source. Reference implementation: Lightning Flow Scanner, hardcoded-url (MIT)
Is this rule worth checking?
Votes and comments are published here. We read them, and we publish what we change with the reasoning — a vote does not move a rule on its own.