Appendix E: Salesforce Code Analyzer - Engine Reference¶
This appendix provides detailed reference material for the engines bundled with Salesforce Code Analyzer. The architectural positioning of Code Analyzer as one option among several is covered in Section 5; this appendix is a practical reference for teams that have selected Code Analyzer as their static analysis tool. Every rule that Code Analyzer ships, engine by engine, is listed in Appendix F.5.
Official documentation: Salesforce Code Analyzer, Salesforce Developers GitHub Action: Run Salesforce Code Analyzer, GitHub Marketplace
Standalone Engine Usage¶
Several of the engines that Code Analyzer orchestrates also exist as independent, standalone tools with their own CLI, documentation, and community ecosystems. Teams that prefer direct engine control, need to pin to a specific engine version independently of the Code Analyzer release cycle, or need to integrate with tooling that does not support the Code Analyzer CLI can invoke these engines directly. When using standalone engines, output parsing, severity thresholding, SARIF conversion, and PR annotation must be handled by custom workflow steps. The jq command-line JSON processor (pre-installed on GitHub-hosted runners) and xq (installed via pip install yq) are particularly useful for parsing raw engine output.
The standalone-capable engines are:
- PMD -
pmd check| PMD documentation | PMD on GitHub - ESLint -
eslint| ESLint documentation | ESLint on GitHub - RetireJS -
retire(npm package) | Retire.js on GitHub - CPD - ships with the PMD distribution, invoked via
pmd cpd
The Flow Analyzer and Regex engines are specific to Code Analyzer and do not have standalone equivalents.
Installation and Prerequisites¶
Runner prerequisites by engine:
- Node.js v20 or later - required universally
- Java v11 or later - required by PMD, CPD, and Salesforce Graph Engine
- Python v3.10 or later - required by the Flow Scanner engine
Engines with unsatisfied prerequisites should be explicitly disabled in code-analyzer.yml:
The code-analyzer.yml Configuration File¶
The central configuration artifact for Code Analyzer. Should reside in the root directory of the consuming repository - the default location that Code Analyzer expects without additional configuration. Where project structure requires a non-root location, all invocations must explicitly reference the file path via --config-file.
The command to create and update the config file is:
echo 'y' | sf code-analyzer config \
--include-unmodified-rules \
--rule-selector all \
--config-file code-analyzer.yml \
--output-file code-analyzer.yml
Examples and configuration options are in the documentation.
Sample: a starting-point code-analyzer.yml is on a page of its own, in full.
Expand to show Code Analyzer configuration file
code-analyzer.yml
config_root: null
log_folder: null
log_level: 4
ignores:
files:
- '**/node_modules/**'
suppressions:
disable_suppressions: false
"docs/":
- rule_selector: "pmd:AvoidJavaScriptUrlHtmlLwcAura"
max_suppressed_violations: 0
reason: "Generated documentation. An example: set max_suppressed_violations to the count this folder has today, or null for no limit; 0 suppresses nothing"
"doc-assets/":
- rule_selector: "pmd:AvoidJavaScriptUrlHtmlLwcAura"
max_suppressed_violations: 0
reason: "Generated documentation. An example: set max_suppressed_violations to the count this folder has today, or null for no limit; 0 suppresses nothing"
rules:
retire-js:
"LibraryWithKnownCriticalSeverityVulnerability":
severity: 1
tags:
- Recommended
- Security
- JavaScript
"LibraryWithKnownHighSeverityVulnerability":
severity: 2
tags:
- Recommended
- Security
- JavaScript
"LibraryWithKnownMediumSeverityVulnerability":
severity: 3
tags:
- Recommended
- Security
- JavaScript
"LibraryWithKnownLowSeverityVulnerability":
severity: 4
tags:
- Recommended
- Security
- JavaScript
regex:
"NoTrailingWhitespace":
severity: 5
tags:
- Recommended
- CodeStyle
- Apex
"AvoidTermsWithImplicitBias":
severity: 4 # Modified from: 5
tags:
- Recommended
- BestPractices
"AvoidOldSalesforceApiVersions":
severity: 2
tags:
- Recommended
- Security
- XML
"AvoidGetHeapSizeInLoop":
severity: 2
tags:
- Recommended
- Performance
- Apex
"MinVersionForAbstractVirtualClassesWithPrivateMethod":
severity: 2
tags:
- Recommended
- BestPractices
- Apex
"NoUnapprovedSuppression":
severity: 2
tags:
- Custom
- Regex
- Security
- DevSecOps
"NoUnapprovedEslintSuppression":
severity: 2
tags:
- Custom
- Regex
- Security
- DevSecOps
"NoUnresolvedTodosApex":
severity: 5
tags:
- Custom
- Regex
- BestPractices
- DevSecOps
"NoUnresolvedTodosJavaScript":
severity: 5
tags:
- Custom
- Regex
- BestPractices
- DevSecOps
"NoUnresolvedTodosMarkup":
severity: 5
tags:
- Custom
- Regex
- BestPractices
- DevSecOps
"NoEmptyBlockComments":
severity: 3
tags:
- Custom
- Regex
- CodeStyle
- DevSecOps
"NoConsecutiveBlankLines":
severity: 3
tags:
- Custom
- Regex
- CodeStyle
- DevSecOps
"NoSfdocDefaultAuthor":
severity: 2
tags:
- Custom
- Regex
- CodeStyle
- DevSecOps
"NoPolyfillIo":
severity: 2
tags:
- Custom
- Regex
- Security
- DevSecOps
"NoConsoleInVisualforce":
severity: 2
tags:
- Custom
- Regex
- Security
- DevSecOps
"VisualforceHeaderComment":
severity: 4
tags:
- Custom
- Regex
- Documentation
- DevSecOps
"NoMixedIndentation":
severity: 3
tags:
- Recommended
- CodeStyle
- Apex
disabled: true
eslint:
"@lwc/lwc-platform/no-aura":
severity: 2 # Modified from: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/no-aura-libs":
severity: 2 # Modified from: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/no-community-import":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/no-create-context-provider":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-deprecated-module-import":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-dynamic-import-identifier":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-inline-disable":
severity: 2 # Modified from: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-create":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-dispatch":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-execute":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-execute-controller-with-client-def":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-execute-privileged":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-execute-raw-response":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-execute-with-callback":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-get-event":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-get-module":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-is-external-definition":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-load-definitions":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-module-instrumentation":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-module-storage":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-register":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-render":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-interop-sanitize":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-lds-aura-controller-method":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-process-env":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc-platform/no-restricted-namespaces":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/no-site-import":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/no-wire-service":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc-platform/valid-dynamic-import-hint":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/newer-version-available":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"@lwc/lwc/no-api-reassignments":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/no-async-operation":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/no-attributes-during-construction":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/no-deprecated":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/no-disallowed-lwc-imports":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/no-document-query":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/no-inner-html":
severity: 2
tags:
- Recommended
- LWC
- Security
- JavaScript
"@lwc/lwc/no-leading-uppercase-api-name":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/no-template-children":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/no-unexpected-wire-adapter-usages":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/no-unknown-wire-adapters":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/prefer-custom-event":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"@lwc/lwc/valid-api":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/valid-graphql-wire-adapter-callback-parameters":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/valid-track":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@lwc/lwc/valid-wire":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@salesforce-ux/slds/enforce-bem-usage":
severity: 4
tags:
- Recommended
- SLDS
- BestPractices
- HTML
- Fixable
"@salesforce-ux/slds/enforce-component-hook-naming-convention":
severity: 4
tags:
- Recommended
- SLDS
- CodeStyle
- CSS
- Fixable
"@salesforce-ux/slds/enforce-sds-to-slds-hooks":
severity: 4
tags:
- Recommended
- SLDS
- Design
- CSS
- Fixable
"@salesforce-ux/slds/lwc-token-to-slds-hook":
severity: 3
tags:
- Recommended
- SLDS
- ErrorProne
- CSS
- Fixable
"@salesforce-ux/slds/modal-close-button-issue":
severity: 3
tags:
- Recommended
- SLDS
- ErrorProne
- HTML
- Fixable
"@salesforce-ux/slds/no-deprecated-classes-slds2":
severity: 3
tags:
- Recommended
- SLDS
- ErrorProne
- HTML
"@salesforce-ux/slds/no-hardcoded-values-slds2":
severity: 4
tags:
- Recommended
- SLDS
- Design
- CSS
- Fixable
"@salesforce-ux/slds/no-slds-class-overrides":
severity: 4
tags:
- Recommended
- SLDS
- BestPractices
- CSS
"@salesforce-ux/slds/no-slds-namespace-for-custom-hooks":
severity: 4
tags:
- Recommended
- SLDS
- BestPractices
- CSS
"@salesforce-ux/slds/no-slds-private-var":
severity: 2 # Modified from: 3
tags:
- Recommended
- SLDS
- ErrorProne
- CSS
- Fixable
"@salesforce-ux/slds/no-slds-var-without-fallback":
severity: 3
tags:
- Recommended
- SLDS
- ErrorProne
- CSS
- Fixable
"@salesforce-ux/slds/no-sldshook-fallback-for-lwctoken":
severity: 4
tags:
- Recommended
- SLDS
- BestPractices
- CSS
"@salesforce-ux/slds/no-unsupported-hooks-slds2":
severity: 3
tags:
- Recommended
- SLDS
- ErrorProne
- CSS
"@salesforce-ux/slds/reduce-annotations":
severity: 2 # Modified from: 4
tags:
- Recommended
- SLDS
- BestPractices
- CSS
"@salesforce/lightning/valid-apex-method-invocation":
severity: 3
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"@typescript-eslint/adjacent-overload-signatures":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/array-type":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/await-thenable":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/ban-tslint-comment":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/class-literal-property-style":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/class-methods-use-this":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/consistent-generic-constructors":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/consistent-indexed-object-style":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/consistent-return":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/consistent-type-assertions":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/consistent-type-definitions":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/consistent-type-exports":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/consistent-type-imports":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/default-param-last":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/dot-notation":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/explicit-function-return-type":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/explicit-member-accessibility":
severity: 2
tags:
- ErrorProne
- TypeScript
- Fixable
"@typescript-eslint/explicit-module-boundary-types":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/init-declarations":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/max-params":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/member-ordering":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/method-signature-style":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/naming-convention":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-array-delete":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-base-to-string":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-confusing-non-null-assertion":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-confusing-void-expression":
severity: 2
tags:
- ErrorProne
- TypeScript
- Fixable
"@typescript-eslint/no-deprecated":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-dupe-class-members":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-duplicate-type-constituents":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-dynamic-delete":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-empty-function":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-extraneous-class":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-floating-promises":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-for-in-array":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-implied-eval":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-import-type-side-effects":
severity: 2
tags:
- ErrorProne
- TypeScript
- Fixable
"@typescript-eslint/no-inferrable-types":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-invalid-this":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-invalid-void-type":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-magic-numbers":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-meaningless-void-operator":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-misused-promises":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-misused-spread":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-mixed-enums":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-non-null-asserted-nullish-coalescing":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-non-null-assertion":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-redeclare":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-redundant-type-constituents":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-restricted-types":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-shadow":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-unnecessary-boolean-literal-compare":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-unnecessary-condition":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-unnecessary-parameter-property-assignment":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-unnecessary-qualifier":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-unnecessary-template-expression":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-unnecessary-type-arguments":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-unnecessary-type-assertion":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-unnecessary-type-conversion":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-unnecessary-type-parameters":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-argument":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-assignment":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-call":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-enum-comparison":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/no-unsafe-member-access":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-return":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-type-assertion":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unsafe-unary-minus":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-unused-private-class-members":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-use-before-define":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-useless-constructor":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/no-useless-default-assignment":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/no-useless-empty-export":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/non-nullable-type-assertion-style":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/only-throw-error":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/parameter-properties":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/prefer-destructuring":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-enum-initializers":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-find":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-for-of":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-function-type":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-includes":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-literal-enum-member":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-nullish-coalescing":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-optional-chain":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-promise-reject-errors":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-readonly":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-readonly-parameter-types":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/prefer-reduce-type-parameter":
severity: 2
tags:
- ErrorProne
- TypeScript
- Fixable
"@typescript-eslint/prefer-regexp-exec":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-return-this-type":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/prefer-string-starts-ends-with":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/promise-function-async":
severity: 3
tags:
- BestPractices
- TypeScript
- Fixable
"@typescript-eslint/related-getter-setter-pairs":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/require-array-sort-compare":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/require-await":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/restrict-plus-operands":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/restrict-template-expressions":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/return-await":
severity: 2
tags:
- ErrorProne
- TypeScript
- Fixable
"@typescript-eslint/strict-boolean-expressions":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/strict-void-return":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/switch-exhaustiveness-check":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/unbound-method":
severity: 2
tags:
- ErrorProne
- TypeScript
"@typescript-eslint/unified-signatures":
severity: 3
tags:
- BestPractices
- TypeScript
"@typescript-eslint/use-unknown-in-catch-callback-variable":
severity: 3
tags:
- BestPractices
- TypeScript
"accessor-pairs":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"array-callback-return":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"arrow-body-style":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"block-scoped-var":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"camelcase":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"capitalized-comments":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"class-methods-use-this":
severity: 3
tags:
- BestPractices
- JavaScript
"complexity":
severity: 4 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"consistent-return":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"consistent-this":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"constructor-super":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"curly":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"default-case":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"default-case-last":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"default-param-last":
severity: 3
tags:
- BestPractices
- JavaScript
"dot-notation":
severity: 3
tags:
- BestPractices
- JavaScript
- Fixable
- DevSecOps
"eqeqeq":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"for-direction":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"func-name-matching":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"func-names":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"func-style":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"getter-return":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"grouped-accessor-pairs":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"guard-for-in":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"id-denylist":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"id-length":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"id-match":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"import/default":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"import/export":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"import/named":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"import/namespace":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"init-declarations":
severity: 3
tags:
- BestPractices
- JavaScript
"jest/expect-expect":
severity: 5
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-alias-methods":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"jest/no-commented-out-tests":
severity: 5
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-conditional-expect":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"jest/no-disabled-tests":
severity: 5
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-done-callback":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-export":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-focused-tests":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-identical-title":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-interpolation-in-snapshots":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"jest/no-jasmine-globals":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"jest/no-mocks-import":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"jest/no-standalone-expect":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/no-test-prefixes":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"jest/valid-describe-callback":
severity: 2
tags:
- Recommended
- LWC
- ErrorProne
- JavaScript
"jest/valid-expect":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"jest/valid-expect-in-promise":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
"jest/valid-title":
severity: 3
tags:
- Recommended
- LWC
- BestPractices
- JavaScript
- Fixable
"logical-assignment-operators":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"max-classes-per-file":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"max-depth":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"max-lines":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"max-lines-per-function":
severity: 4 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"max-nested-callbacks":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"max-params":
severity: 3
tags:
- BestPractices
- JavaScript
"max-statements":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"new-cap":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"no-alert":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-array-constructor":
severity: 3
tags:
- BestPractices
- JavaScript
- Fixable
"no-async-promise-executor":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-await-in-loop":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-bitwise":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-caller":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-case-declarations":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-class-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-compare-neg-zero":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-cond-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-console":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-const-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-constant-binary-expression":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-constant-condition":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-constructor-return":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-continue":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"no-control-regex":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-debugger":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-delete-var":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-div-regex":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-dupe-args":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-dupe-class-members":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-dupe-else-if":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-dupe-keys":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-duplicate-case":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-duplicate-imports":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-else-return":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-empty":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-empty-character-class":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-empty-function":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-empty-pattern":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-empty-static-block":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-eq-null":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-eval":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-ex-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-extend-native":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-extra-bind":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-extra-boolean-cast":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-extra-label":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-fallthrough":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-func-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-global-assign":
severity: 2 # Modified from: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-implicit-coercion":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-implicit-globals":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-implied-eval":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-import-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-inline-comments":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-inner-declarations":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-invalid-regexp":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-invalid-this":
severity: 3
tags:
- BestPractices
- JavaScript
"no-irregular-whitespace":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-iterator":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-label-var":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-labels":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-lone-blocks":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"no-lonely-if":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"no-loop-func":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-loss-of-precision":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-magic-numbers":
severity: 3
tags:
- BestPractices
- JavaScript
"no-misleading-character-class":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-multi-assign":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-multi-str":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-negated-condition":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-nested-ternary":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-new":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-new-func":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-new-native-nonconstructor":
severity: 2
tags:
- ErrorProne
- JavaScript
- DevSecOps
"no-new-wrappers":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-nonoctal-decimal-escape":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-obj-calls":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-object-constructor":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-octal":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-octal-escape":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-param-reassign":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-plusplus":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-promise-executor-return":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
"no-proto":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-prototype-builtins":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-redeclare":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
"no-regex-spaces":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-restricted-exports":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-restricted-globals":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-restricted-imports":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-restricted-properties":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-restricted-syntax":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"no-return-assign":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-script-url":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-self-assign":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-self-compare":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-sequences":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-setter-return":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-shadow":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-shadow-restricted-names":
severity: 2 # Modified from: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-sparse-arrays":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-template-curly-in-string":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
"no-ternary":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-this-before-super":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-throw-literal":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-unassigned-vars":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-undef":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-undef-init":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-undefined":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-underscore-dangle":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-unmodified-loop-condition":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
"no-unneeded-ternary":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-unreachable":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-unreachable-loop":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-unsafe-finally":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-unsafe-negation":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-unsafe-optional-chaining":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-unused-expressions":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-unused-labels":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
- Fixable
"no-unused-private-class-members":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-unused-vars":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
"no-use-before-define":
severity: 2
tags:
- ErrorProne
- JavaScript
- DevSecOps
"no-useless-assignment":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
- DevSecOps
"no-useless-backreference":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"no-useless-call":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-useless-catch":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-useless-computed-key":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-useless-concat":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-useless-constructor":
severity: 3
tags:
- BestPractices
- JavaScript
- DevSecOps
"no-useless-escape":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"no-useless-rename":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-useless-return":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"no-var":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
"no-void":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"no-warning-comments":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"no-with":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
"object-shorthand":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"one-var":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"operator-assignment":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"prefer-arrow-callback":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"prefer-const":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
"prefer-destructuring":
severity: 3
tags:
- BestPractices
- JavaScript
- Fixable
"prefer-exponentiation-operator":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"prefer-named-capture-group":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"prefer-numeric-literals":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"prefer-object-has-own":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"prefer-object-spread":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"prefer-promise-reject-errors":
severity: 3
tags:
- BestPractices
- JavaScript
"prefer-regex-literals":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"prefer-rest-params":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"prefer-spread":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"prefer-template":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"preserve-caught-error":
severity: 4
tags:
- BestPractices
- JavaScript
- TypeScript
"radix":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"react-hooks/exhaustive-deps":
severity: 3
tags:
- Recommended
- React
- Design
- JavaScript
- TypeScript
- Fixable
"react-hooks/rules-of-hooks":
severity: 2
tags:
- Recommended
- React
- Design
- JavaScript
- TypeScript
"react/boolean-prop-naming":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/button-has-type":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/checked-requires-onchange-or-readonly":
severity: 3
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/default-props-match-prop-types":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/destructuring-assignment":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/display-name":
severity: 3
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/forbid-component-props":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/forbid-dom-props":
severity: 3
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/forbid-elements":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/forbid-foreign-prop-types":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/forbid-prop-types":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/forward-ref-uses-ref":
severity: 4
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/function-component-definition":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/hook-use-state":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/iframe-missing-sandbox":
severity: 2
tags:
- React
- Security
- JavaScript
- TypeScript
"react/jsx-boolean-value":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/jsx-curly-brace-presence":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/jsx-filename-extension":
severity: 3
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/jsx-fragments":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/jsx-handler-names":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/jsx-key":
severity: 3
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/jsx-max-depth":
severity: 2
tags:
- React
- Design
- JavaScript
- TypeScript
"react/jsx-no-bind":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/jsx-no-comment-textnodes":
severity: 3
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/jsx-no-constructed-context-values":
severity: 2
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/jsx-no-duplicate-props":
severity: 2
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/jsx-no-leaked-render":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
- Fixable
"react/jsx-no-literals":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/jsx-no-script-url":
severity: 2
tags:
- React
- Security
- JavaScript
- TypeScript
"react/jsx-no-target-blank":
severity: 2
tags:
- Recommended
- React
- Security
- JavaScript
- TypeScript
- Fixable
"react/jsx-no-undef":
severity: 3
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/jsx-no-useless-fragment":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
- Fixable
"react/jsx-pascal-case":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/jsx-props-no-spread-multi":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/jsx-props-no-spreading":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/jsx-sort-props":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/jsx-uses-vars":
severity: 4
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-access-state-in-setstate":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-adjacent-inline-elements":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/no-array-index-key":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/no-arrow-function-lifecycle":
severity: 3
tags:
- React
- Design
- JavaScript
- TypeScript
- Fixable
"react/no-children-prop":
severity: 3
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-danger":
severity: 2
tags:
- React
- Security
- JavaScript
- TypeScript
"react/no-danger-with-children":
severity: 2
tags:
- Recommended
- React
- Security
- JavaScript
- TypeScript
"react/no-deprecated":
severity: 4
tags:
- Recommended
- React
- Design
- JavaScript
- TypeScript
"react/no-did-mount-set-state":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/no-did-update-set-state":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/no-direct-mutation-state":
severity: 2
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-find-dom-node":
severity: 2
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-invalid-html-attribute":
severity: 4
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-is-mounted":
severity: 2
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-multi-comp":
severity: 4
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-namespace":
severity: 2
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-object-type-as-default-prop":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/no-redundant-should-component-update":
severity: 4
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-render-return-value":
severity: 3
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-set-state":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
"react/no-string-refs":
severity: 4
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/no-this-in-sfc":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-typos":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-unescaped-entities":
severity: 3
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-unknown-property":
severity: 3
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
- Fixable
"react/no-unsafe":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-unstable-nested-components":
severity: 4
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/no-unused-class-component-methods":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
"react/no-unused-prop-types":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
"react/no-unused-state":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
"react/no-will-update-set-state":
severity: 3
tags:
- React
- Design
- JavaScript
- TypeScript
"react/prefer-es6-class":
severity: 3
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/prefer-exact-props":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"react/prefer-read-only-props":
severity: 3
tags:
- React
- BestPractices
- JavaScript
- TypeScript
- Fixable
"react/prefer-stateless-function":
severity: 4
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/prop-types":
severity: 3
tags:
- Recommended
- React
- BestPractices
- JavaScript
- TypeScript
"react/require-default-props":
severity: 3
tags:
- React
- Design
- JavaScript
- TypeScript
"react/require-optimization":
severity: 3
tags:
- React
- Performance
- JavaScript
- TypeScript
"react/require-render-return":
severity: 2
tags:
- Recommended
- React
- ErrorProne
- JavaScript
- TypeScript
"react/self-closing-comp":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/sort-comp":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/sort-default-props":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/sort-prop-types":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
- Fixable
"react/state-in-constructor":
severity: 4
tags:
- React
- CodeStyle
- JavaScript
- TypeScript
"react/static-property-placement":
severity: 4
tags:
- React
- Design
- JavaScript
- TypeScript
"react/style-prop-object":
severity: 4
tags:
- React
- BestPractices
- JavaScript
- TypeScript
"react/void-dom-elements-no-children":
severity: 3
tags:
- React
- ErrorProne
- JavaScript
- TypeScript
"require-atomic-updates":
severity: 2
tags:
- ErrorProne
- JavaScript
- TypeScript
"require-await":
severity: 3
tags:
- BestPractices
- JavaScript
"require-unicode-regexp":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"require-yield":
severity: 3
tags:
- Recommended
- BestPractices
- JavaScript
- TypeScript
"sort-imports":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"sort-keys":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
"sort-vars":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"strict":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
"symbol-description":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- CodeStyle
- DevSecOps
"unicode-bom":
severity: 4
tags:
- CodeStyle
- JavaScript
- TypeScript
- Fixable
- DevSecOps
"use-isnan":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"valid-typeof":
severity: 2
tags:
- Recommended
- ErrorProne
- JavaScript
- TypeScript
"vars-on-top":
severity: 5 # Modified from: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- DevSecOps
"yoda":
severity: 3
tags:
- BestPractices
- JavaScript
- TypeScript
- Fixable
- CodeStyle
- DevSecOps
"@typescript-eslint/ban-ts-comment":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-array-constructor":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/no-duplicate-enum-values":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-empty-object-type":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"@typescript-eslint/no-explicit-any":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/no-extra-non-null-assertion":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/no-misused-new":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-namespace":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"@typescript-eslint/no-non-null-asserted-optional-chain":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-require-imports":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-this-alias":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"@typescript-eslint/no-unnecessary-type-constraint":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"@typescript-eslint/no-unsafe-declaration-merging":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-unsafe-function-type":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
disabled: true
"@typescript-eslint/no-unused-expressions":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"@typescript-eslint/no-unused-vars":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/no-wrapper-object-types":
severity: 2
tags:
- Recommended
- ErrorProne
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/prefer-as-const":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/prefer-namespace-keyword":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
- Fixable
disabled: true
"@typescript-eslint/triple-slash-reference":
severity: 3
tags:
- Recommended
- BestPractices
- TypeScript
disabled: true
"jsx-a11y/alt-text":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/anchor-has-content":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/anchor-is-valid":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/aria-activedescendant-has-tabindex":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/aria-props":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/aria-proptypes":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/aria-role":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/aria-unsupported-elements":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/autocomplete-valid":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/click-events-have-key-events":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/heading-has-content":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/html-has-lang":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/iframe-has-title":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/img-redundant-alt":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/interactive-supports-focus":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/label-has-associated-control":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/media-has-caption":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/mouse-events-have-key-events":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-access-key":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-autofocus":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-distracting-elements":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-interactive-element-to-noninteractive-role":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-noninteractive-element-interactions":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-noninteractive-element-to-interactive-role":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-noninteractive-tabindex":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-redundant-roles":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/no-static-element-interactions":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/role-has-required-aria-props":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/role-supports-aria-props":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/scope":
severity: 3
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
"jsx-a11y/tabindex-no-positive":
severity: 2
tags:
- Recommended
- A11y
- React
- BestPractices
- JavaScript
- TypeScript
disabled: true
flow:
"CyclicSubflow":
severity: 1
tags:
- Recommended
- Performance
- XML
"DbInLoop":
severity: 2
tags:
- Recommended
- Performance
- XML
"DefaultCopy":
severity: 3
tags:
- Recommended
- CodeStyle
- XML
"MissingDescription":
severity: 4
tags:
- CodeStyle
- XML
- DevSecOps
"MissingFaultHandler":
severity: 3 # Modified from: 2
tags:
- BestPractices
- XML
- DevSecOps
"MissingNextValueConnector":
severity: 1
tags:
- Recommended
- BestPractices
- XML
"PreventPassingUserDataIntoElementWithoutSharing":
severity: 2
tags:
- Recommended
- Security
- XML
"PreventPassingUserDataIntoElementWithSharing":
severity: 4
tags:
- Recommended
- Security
- XML
"SameRecordUpdate":
severity: 3
tags:
- Recommended
- Security
- XML
"TriggerCallout":
severity: 2
tags:
- Recommended
- Performance
- XML
"TriggerEntryCriteria":
severity: 2
tags:
- Recommended
- Performance
- XML
"TriggerWaitEvent":
severity: 2
tags:
- Recommended
- Performance
- XML
"UnreachableElement":
severity: 4
tags:
- BestPractices
- XML
- DevSecOps
"UnusedResource":
severity: 3
tags:
- BestPractices
- XML
- DevSecOps
"HardcodedId":
severity: 3
tags:
- Recommended
- BestPractices
- XML
disabled: true
pmd:
"AnnotationsNamingConventions":
severity: 1 # Modified from: 4
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"ApexAssertionsShouldIncludeMessage":
severity: 3
tags:
- BestPractices
- Apex
- StockRules
- DevSecOps
"ApexBadCrypto":
severity: 1 # Modified from: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexCSRF":
severity: 1
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexDangerousMethods":
severity: 2 # Modified from: 3
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexDoc":
severity: 4
tags:
- Recommended
- Documentation
- Apex
- StockRules
"ApexInsecureEndpoint":
severity: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexOpenRedirect":
severity: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexSOQLInjection":
severity: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexSuggestUsingNamedCred":
severity: 1 # Modified from: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexUnitTestClassShouldHaveAsserts":
severity: 2 # Modified from: 3
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"ApexUnitTestClassShouldHaveRunAs":
severity: 2 # Modified from: 4
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"ApexUnitTestMethodShouldHaveIsTestAnnotation":
severity: 2
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"ApexUnitTestShouldNotUseSeeAllDataTrue":
severity: 2
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"ApexXSSFromEscapeFalse":
severity: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"ApexXSSFromURLParam":
severity: 2
tags:
- Recommended
- Security
- Apex
- StockRules
"AssignmentInOperand":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"AvoidApiSessionId":
severity: 2
tags:
- AppExchange
- Security
- XML
"AvoidAuraWithLockerDisabled":
severity: 1
tags:
- AppExchange
- Security
- XML
- DevSecOps
"AvoidBooleanMethodParameters":
severity: 4 # Modified from: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"AvoidChangeProtectionUnprotected":
severity: 1
tags:
- AppExchange
- Security
- Apex
"AvoidConsoleStatements":
severity: 2 # Modified from: 3
tags:
- Performance
- JavaScript
- StockRules
- DevSecOps
"AvoidCreateElementScriptLinkTag":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
"AvoidDebugStatements":
severity: 2 # Modified from: 4
tags:
- Recommended
- Performance
- Apex
- StockRules
"AvoidDeeplyNestedIfStmts":
severity: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"AvoidDirectAccessTriggerMap":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"AvoidDisableProtocolSecurityRemoteSiteSetting":
severity: 3
tags:
- AppExchange
- Security
- XML
"AvoidFutureAnnotation":
severity: 4
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"AvoidGetInstanceWithTaint":
severity: 3
tags:
- AppExchange
- Security
- Apex
"AvoidGlobalInstallUninstallHandlers":
severity: 1
tags:
- AppExchange
- Security
- Apex
"AvoidGlobalModifier":
severity: 4 # Modified from: 3
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"AvoidHardCodedCredentialsInAura":
severity: 2
tags:
- AppExchange
- Security
- HTML
- DevSecOps
"AvoidHardcodedCredentialsInFieldDecls":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidHardcodedCredentialsInHttpHeader":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidHardcodedCredentialsInSetPassword":
severity: 1
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidHardcodedCredentialsInVarAssign":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidHardcodedCredentialsInVarDecls":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidHardcodedSecretsInVFAttrs":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"AvoidHardcodingId":
severity: 1 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"AvoidInlineStyles":
severity: 3 # Modified from: 4
tags:
- BestPractices
- HTML
- StockRules
- DevSecOps
"AvoidInsecureHttpRemoteSiteSetting":
severity: 3
tags:
- AppExchange
- Security
- XML
"AvoidInterfaceAsMapKey":
severity: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"AvoidInvalidCrudContentDistribution":
severity: 3
tags:
- AppExchange
- Security
- Apex
"AvoidJavaScriptCustomObject":
severity: 2
tags:
- AppExchange
- Security
- XML
"AvoidJavaScriptHomePageComponent":
severity: 2
tags:
- AppExchange
- Security
- XML
"AvoidJavaScriptInUrls":
severity: 1
tags:
- AppExchange
- Security
- XML
"AvoidJavaScriptWebLink":
severity: 2
tags:
- AppExchange
- Security
- XML
"AvoidLmcIsExposedTrue":
severity: 2
tags:
- AppExchange
- Security
- XML
- DevSecOps
"AvoidLogicInTrigger":
severity: 2 # Modified from: 3
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"AvoidLwcBubblesComposedTrue":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- JavaScript
- DevSecOps
"AvoidNonExistentAnnotations":
severity: 3 # Modified from: 4
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"AvoidNonRestrictiveQueries":
severity: 2 # Modified from: 4
tags:
- Recommended
- Performance
- Apex
- StockRules
"AvoidSControls":
severity: 1
tags:
- AppExchange
- Security
- XML
- DevSecOps
"AvoidSecurityEnforcedOldApiVersion":
severity: 3
tags:
- AppExchange
- Security
- Apex
"AvoidStatefulDatabaseResult":
severity: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"AvoidTrailingComma":
severity: 2
tags:
- ErrorProne
- JavaScript
- StockRules
- DevSecOps
"AvoidUnauthorizedApiSessionIdInApex":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidUnauthorizedApiSessionIdInVisualforce":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"AvoidUnauthorizedGetSessionIdInApex":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- Apex
- DevSecOps
"AvoidUnauthorizedGetSessionIdInVisualforce":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"AvoidUnescapedHtmlInAura":
severity: 2
tags:
- AppExchange
- Security
- HTML
"AvoidUnsafePasswordManagementUse":
severity: 1
tags:
- AppExchange
- Security
- Apex
"AvoidWithStatement":
severity: 2
tags:
- BestPractices
- JavaScript
- StockRules
- DevSecOps
"ClassNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"CognitiveComplexity":
severity: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"ConsistentReturn":
severity: 2 # Modified from: 3
tags:
- BestPractices
- JavaScript
- StockRules
- DevSecOps
"CyclomaticComplexity":
severity: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"DebugsShouldUseLoggingLevel":
severity: 4
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"EagerlyLoadedDescribeSObjectResult":
severity: 2
tags:
- Recommended
- Performance
- Apex
- StockRules
"EmptyCatchBlock":
severity: 2
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"EmptyIfStmt":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"EmptyStatementBlock":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"EmptyTryOrFinallyBlock":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"EmptyWhileStmt":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"EqualComparison":
severity: 2 # Modified from: 3
tags:
- ErrorProne
- JavaScript
- StockRules
- DevSecOps
"FieldDeclarationsShouldBeAtStart":
severity: 4 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"FieldNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"ForLoopsMustUseBraces":
severity: 2 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"ForLoopsMustUseBraces-javascript":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"FormalParameterNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"GlobalVariable":
severity: 2
tags:
- BestPractices
- JavaScript
"IfElseStmtsMustUseBraces":
severity: 2 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"IfElseStmtsMustUseBraces-javascript":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"IfStmtsMustUseBraces":
severity: 2 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"IfStmtsMustUseBraces-javascript":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"InaccessibleAuraEnabledGetter":
severity: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"InaccurateNumericLiteral":
severity: 2 # Modified from: 3
tags:
- ErrorProne
- JavaScript
"InvocableClassNoArgConstructor":
severity: 2 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"LimitConnectedAppScope":
severity: 3
tags:
- AppExchange
- Security
- XML
"LoadCSSApexStylesheet":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"LoadCSSLinkHref":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"LoadJavaScriptHtmlScript":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"LoadJavaScriptIncludeScript":
severity: 2
tags:
- AppExchange
- Security
- Visualforce
- DevSecOps
"LocalVariableNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"MethodNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"MethodWithSameNameAsEnclosingClass":
severity: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"MissingEncoding":
severity: 3
tags:
- BestPractices
- XML
"MistypedCDATASection":
severity: 3
tags:
- ErrorProne
- XML
"NoElseReturn":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"OneDeclarationPerLine":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"OperationWithHighCostInLoop":
severity: 3
tags:
- Recommended
- Performance
- Apex
- StockRules
"OperationWithLimitsInLoop":
severity: 2 # Modified from: 3
tags:
- Recommended
- Performance
- Apex
- StockRules
"OverrideBothEqualsAndHashcode":
severity: 2
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"PropertyNamingConventions":
severity: 1 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"ProtectSensitiveData":
severity: 2 # Modified from: 3
tags:
- AppExchange
- Security
- XML
- DevSecOps
"QueueableWithoutFinalizer":
severity: 5 # Modified from: 4
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"ScopeForInVariable":
severity: 2
tags:
- BestPractices
- JavaScript
"StdCyclomaticComplexity":
severity: 3
tags:
- Design
- Apex
"TestMethodsMustBeInTestClasses":
severity: 1 # Modified from: 3
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"TooManyFields":
severity: 4 # Modified from: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"TypeShadowsBuiltInNamespace":
severity: 2
tags:
- Recommended
- ErrorProne
- Apex
- StockRules
"UnnecessaryBlock":
severity: 3
tags:
- CodeStyle
- JavaScript
"UnnecessaryParentheses":
severity: 4
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"UnnecessaryTypeAttribute":
severity: 3
tags:
- BestPractices
- HTML
"UnreachableCode":
severity: 2
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"UnusedLocalVariable":
severity: 3
tags:
- Recommended
- BestPractices
- Apex
- StockRules
"UnusedMethod":
severity: 3
tags:
- Recommended
- Design
- Apex
- StockRules
"UseAltAttributeForImages":
severity: 3
tags:
- BestPractices
- HTML
"UseBaseWithParseInt":
severity: 2
tags:
- BestPractices
- JavaScript
- StockRules
- DevSecOps
"UseHttpsCallbackUrlConnectedApp":
severity: 3
tags:
- AppExchange
- Security
- XML
"VfCsrf":
severity: 2
tags:
- Recommended
- Security
- Visualforce
- StockRules
"VfHtmlStyleTagXss":
severity: 2
tags:
- Recommended
- Security
- Visualforce
- StockRules
"VfUnescapeEl":
severity: 2
tags:
- Recommended
- Security
- Visualforce
- StockRules
"WhileLoopsMustUseBraces":
severity: 2 # Modified from: 3
tags:
- Recommended
- CodeStyle
- Apex
- StockRules
"WhileLoopsMustUseBraces-javascript":
severity: 2 # Modified from: 3
tags:
- CodeStyle
- JavaScript
- StockRules
- DevSecOps
"AbstractClassWithoutAnyMethodApex":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ApexDocDescriptionLength":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AuraEnabledControllerNaming":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidAbsoluteSalesforceUrl":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidAbsoluteSalesforceUrlFlow":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidAbsoluteSalesforceUrlHtml":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"AvoidAbsoluteSalesforceUrlVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidApiSessionIdInApexString":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidDescribeInLoops":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidFlowActionInLoop":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidHardcodedIdFlow":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidHardcodedIdVf":
severity: 1
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidHardcodedIpAddressApex":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidHardcodedIpAddressMetadata":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidHardcodedPageLinkVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidHardcodedResourcePathVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidHardcodedSecretSalesforce":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidHttpReferer":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidIframeVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidInlineStylesInVisualforce":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidInsecureCookies":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidJavaScriptUrlHtmlLwcAura":
severity: 2
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"AvoidJavaScriptUrlVf":
severity: 2
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidMagicNumbers":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidMultipleFormsVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"AvoidNestedFlowLoops":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"AvoidNestedSwitchStmts":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidNonSelectiveSoqlFilter":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidRecordTypeInfosByName":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidSizeOfSoql":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidTrivialPropertyGetters":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidUsingTestIsRunningTest":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"AvoidWeakCryptoAlgorithms":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"BooleanGetMethodNameApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"BrokenNullCheckApex":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"BumpApiVersion":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ButtonWithoutNameHtmlLwcAura":
severity: 2
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ButtonWithoutNameVf":
severity: 2
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"CheckboxFieldNamePrefix":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"CombineNestedIfStatements":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DeclareAccessOnMethods":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DeprecatedDocumentationRequired":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DmlInLoopAcrossMethods":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DoNotRunAsCurrentUser":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DoNotRunFlowInSystemMode":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"DoNotUseProcessBuilder":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"DoNotUseWithoutSharing":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"DoNotUseWorkflow":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"EmailAddressInLiteral":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"EmptyInitializer":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ExceptionDocumentationRequired":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"FieldComplianceCategory":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FieldDataSensitivity":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FieldNameMatchesClassName":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"FieldNameMatchesMethodName":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"FieldPiiMinimumSensitivity":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FieldsetWithoutLegendHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"FieldsetWithoutLegendVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"FixDuplicateConditions":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"FlagSystemMode":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"FlowAllowBackAfterRecordChange":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowDecisionQuestion":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowDeployAsActiveNotEnabled":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowDraft":
severity: 5
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowElementVerb":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowGetRecordsAllFields":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowGetRecordsWithoutFaultPath":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowGetRecordsWithoutFilter":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowGetRecordsWithoutNullCheck":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowMissingTriggerOrder":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowNameConvention":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowNotAutoLayout":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FlowResourcePrefix":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"FrameWithoutTitleHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"FrameWithoutTitleVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"HotspotDeserializeJson":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"HotspotEncrypt":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"IdempotentOperationsApex":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ImageWithEmptyAltHtmlLwcAura":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ImageWithEmptyAltVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"ImageWithoutAltHtmlLwcAura":
severity: 2
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ImageWithoutAltVf":
severity: 2
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"InefficientEmptyStringCheckApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"LayoutTableHtml":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"LayoutTableVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"LayoutTableWithSemanticMarkupHtml":
severity: 2
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"LayoutTableWithSemanticMarkupVf":
severity: 2
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"LightningWebSecurityNotEnabled":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ListItemOutsideListHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ListItemOutsideListVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"LogicInversionApex":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ManageUsers":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MasterDetailReparentable":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionAnalytics":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionComponent":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionCore":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionCustomField":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionCustomObject":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionData":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionEinstein":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionFlow":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionIntegration":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionPermission":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionSharing":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionStandardField":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataDescriptionUserInterface":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataLabelStartsWithCapital":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MetadataNameStartsWithCapital":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MissingStaticMethodInNonInstantiatableClassApex":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"MisuseOfAssertClass":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ModifyOrViewAllData":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ModifyOrViewAllRecordsCustom":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ModifyOrViewAllRecordsStandard":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"MouseEventWithoutKeyboardEventHtml":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"MouseEventWithoutKeyboardEventVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"MultipleTriggersOnObject":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NcssCount":
severity: 4 # Modified from: 3
tags:
- Recommended
- Apex
- Custom
"NestedScriptElement":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"NoColonAfterApexDocTag":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NoCredentialNamedField":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"NoHardcodedWeblinkURLs":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"NoInlineEventHandlerAura":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"NoLastModifiedApexDocTag":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NoLightningOutApplicationAura":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"NoLightningOutInVisualforce":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"NoListCustomSetting":
severity: 2
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"NoMethodsInTriggers":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NonPrivateCustomObjectSharing":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"NonPrivateStandardObjectSharing":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"NonUnitTestContainsAsserts":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NoSecurityEnforced":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NoSingleLetterVariableName":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NoUnnecessaryReturnVariables":
severity: 5
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"NullValueCheckBeforeEmptyCheck":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ObjectWithoutAlternativeHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ObjectWithoutAlternativeVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"ObsoleteFlow":
severity: 3
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"PositionLiteralsFirstInComparisons":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"PreferNullCoalescingOverTernary":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"PreferSafeNavigationOperator":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"PreferSwitchOverIfElseChains":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ProhibitedMetadataType":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"RefactorAssert":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RegexPatternsMustBeStaticFinal":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RepeatedLandmarkWithoutUniqueLabelHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"RepeatedLandmarkWithoutUniqueLabelVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"RequireAccessMode":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireExplicitSharing":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireInnerClassSharing":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireInvocableNoArgConstructor":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireLazyLoadingInGetters":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireOuterClassAccess":
severity: 1
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"RequireSecureCookie":
severity: 2
tags:
- DevSecOpsReferenceRules
- Javascript
- Custom
- DevSecOps
"RequireTestForOrCritical":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ReturnEmptyArrayRatherThanNull":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"ScheduledFlowMinimumApiVersion":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ScreenFlowTextRecordId":
severity: 4
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ServerSideImageMapHtml":
severity: 2
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"ServerSideImageMapVf":
severity: 2
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"SimplifiedTernaryApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"SimplifyBooleanReturnsApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"SimplifyConditionalApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"StatementsShouldBeOnSeparateLines":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"SwitchWithoutWhenElse":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"TableCellHeaderNotFoundHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"TableCellHeaderNotFoundVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"TableHeaderWithoutScopeHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"TableHeaderWithoutScopeVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"TableWithoutCaptionHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"TableWithoutCaptionVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"TableWithoutHeadersHtml":
severity: 4
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"TableWithoutHeadersVf":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"TestClassIsParallel":
severity: 5
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"TestClassWithoutTestCasesApex":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"TriggerNameSuffix":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UnconditionalIfStatementApex":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UnitTestsShouldIncludeStartTest":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UnnecessaryBooleanAssertionApex":
severity: 2
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UnusedNullCheckInEqualsApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UseAreEqualInsteadOfAssertBoolean":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UseAreEqualInsteadOfIsTrue":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UseCollectionIsEmptyApex":
severity: 4
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"UseIsTrueInsteadOfAreEqual":
severity: 3
tags:
- DevSecOpsReferenceRules
- Apex
- Custom
- DevSecOps
"VideoWithoutCaptionsHtml":
severity: 3
tags:
- DevSecOpsReferenceRules
- Html
- Custom
- DevSecOps
"VideoWithoutCaptionsVf":
severity: 3
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"ViewSetupPermissionSet":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"ViewSetupProfile":
severity: 1
tags:
- DevSecOpsReferenceRules
- Xml
- Custom
- DevSecOps
"VisualforceControllerNaming":
severity: 4
tags:
- DevSecOpsReferenceRules
- Visualforce
- Custom
- DevSecOps
"ApexCRUDViolation":
severity: 2
tags:
- Recommended
- Security
- Apex
disabled: true
"ApexSharingViolations":
severity: 3
tags:
- Recommended
- Security
- Apex
disabled: true
"ExcessiveParameterList":
severity: 3
tags:
- Recommended
- Design
- Apex
disabled: true
"ExcessivePublicCount":
severity: 3
tags:
- Recommended
- Design
- Apex
disabled: true
cpd:
"DetectCopyPasteForApex":
severity: 5
tags:
- Recommended
- Design
- Apex
"DetectCopyPasteForHtml":
severity: 5
tags:
- Design
- Html
- DevSecOps
"DetectCopyPasteForJavascript":
severity: 5
tags:
- Recommended
- Design
- Javascript
"DetectCopyPasteForTypescript":
severity: 5
tags:
- Recommended
- Design
- Typescript
"DetectCopyPasteForVisualforce":
severity: 5
tags:
- Recommended
- Design
- Visualforce
"DetectCopyPasteForXml":
severity: 5
tags:
- Design
- Xml
- DevSecOps
sfge:
"ApexFlsViolation":
severity: 2
tags:
- DevPreview
- Security
- Apex
- DevSecOps
"ApexNullPointerException":
severity: 2 # Modified from: 3
tags:
- DevPreview
- ErrorProne
- Apex
- DevSecOps
"AvoidDatabaseOperationInLoop":
severity: 2
tags:
- DevPreview
- Performance
- Apex
- DevSecOps
"AvoidMultipleMassSchemaLookups":
severity: 2
tags:
- DevPreview
- Performance
- Apex
- DevSecOps
"DatabaseOperationsMustUseWithSharing":
severity: 2
tags:
- DevPreview
- Security
- Apex
- DevSecOps
"MissingNullCheckOnSoqlVariable":
severity: 3
tags:
- DevPreview
- Performance
- Apex
- DevSecOps
"UnimplementedType":
severity: 4
tags:
- DevPreview
- Performance
- Apex
- DevSecOps
engines:
retire-js:
disable_engine: false
regex:
disable_engine: false
custom_rules:
NoUnapprovedSuppression:
regex: '/@SuppressWarnings\s*\(|\/\/\s*NOPMD|code-analyzer-suppress/gi'
description: "Suppressions (@SuppressWarnings, // NOPMD, and a code-analyzer-suppress marker) are a blocking violation, cleared by a fix or by an approving review from the owning team"
violation_message: "Suppression found: remove it, or the owning team approves the pull request with it listed"
severity: 2
tags: ["Custom", "Regex", "Security", "DevSecOps"]
file_extensions: [".cls", ".trigger"]
NoUnapprovedEslintSuppression:
regex: '/(?:\/\/|\/\*)\s*eslint-disable(?:-next-line|-line)?\b|\/\*\s*eslint\s+[^*]*?:\s*["'']?(?:off|0)\b/gi'
description: "ESLint suppressions (an eslint-disable comment, or an inline configuration comment that turns a rule off) are a blocking violation, cleared by a fix or by an approving review from the owning team"
violation_message: "ESLint suppression found: remove it, or the owning team approves the pull request with it listed"
severity: 2
tags: ["Custom", "Regex", "Security", "DevSecOps"]
file_extensions: [".js"]
NoUnresolvedTodosApex:
regex: '/(?:(?:(?<!:)\/\/+|\/\*+|^(?<=\/\*(?:(?!\*\/)[\s\S])*)[ \t]*\**)[ \t]*|(?<=(?<!:)\/\/[^\n]*|\/\*(?:(?!\*\/)[\s\S])*)\b(?=(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK):))(?<target>(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK))\b/gm'
description: "TODO, TO-DO, FIXME, FIX-ME, or HACK as the first word of a comment line, or anywhere in a comment when a colon follows it, in Apex, marks work that is not finished. Finish the work, or record it where the team tracks its work, and remove the comment"
violation_message: "Unfinished work in a comment (TODO, TO-DO, FIXME, FIX-ME, or HACK): finish the work, or record it where the team tracks work, and remove the comment"
severity: 5
tags: ["Custom", "Regex", "BestPractices", "DevSecOps"]
file_extensions: [".cls", ".trigger"]
NoUnresolvedTodosJavaScript:
regex: '/(?:(?:(?<!:)\/\/+|\/\*+|^(?<=\/\*(?:(?!\*\/)[\s\S])*)[ \t]*\**)[ \t]*|(?<=(?<!:)\/\/[^\n]*|\/\*(?:(?!\*\/)[\s\S])*)\b(?=(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK):))(?<target>(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK))\b/gm'
description: "TODO, TO-DO, FIXME, FIX-ME, or HACK as the first word of a comment line, or anywhere in a comment when a colon follows it, in JavaScript, static resources included, marks work that is not finished. Finish the work, or record it where the team tracks its work, and remove the comment"
violation_message: "Unfinished work in a comment (TODO, TO-DO, FIXME, FIX-ME, or HACK): finish the work, or record it where the team tracks work, and remove the comment"
severity: 5
tags: ["Custom", "Regex", "BestPractices", "DevSecOps"]
file_extensions: [".js"]
NoUnresolvedTodosMarkup:
regex: '/(?:(?:<!--|^(?<=<!--(?:(?!-->)[\s\S])*))[ \t]*|(?<=<!--(?:(?!-->)[\s\S])*)\b(?=(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK):))(?<target>(?:[Tt][Oo][Dd][Oo]|[Ff][Ii][Xx][Mm][Ee]|TO-DO|FIX-ME|HACK))\b/gm'
description: "TODO, TO-DO, FIXME, FIX-ME, or HACK as the first word of a comment line, or anywhere in a comment when a colon follows it, in Visualforce, Lightning Web Component, and Aura markup, marks work that is not finished. Finish the work, or record it where the team tracks its work, and remove the comment"
violation_message: "Unfinished work in a comment (TODO, TO-DO, FIXME, FIX-ME, or HACK): finish the work, or record it where the team tracks work, and remove the comment"
severity: 5
tags: ["Custom", "Regex", "BestPractices", "DevSecOps"]
file_extensions: [".html", ".cmp", ".page", ".component"]
NoEmptyBlockComments:
regex: '/\/\*[\s*]*\*\//g'
description: "A block comment with nothing in it tells the reader nothing. Write the comment or remove it"
violation_message: "Empty block comment: write the comment or remove it"
severity: 3
tags: ["Custom", "Regex", "CodeStyle", "DevSecOps"]
file_extensions: [".cls", ".trigger"]
NoConsecutiveBlankLines:
regex: '/\n\s*\n\s*\n/g'
description: "Two or more blank lines in a row are reduced to one. Prettier does this in code when it formats a class or a trigger, so the rule finds a file that was committed without Prettier, and blank lines in a block comment, which Prettier keeps. Adapted from sca-extra, https://github.com/starch-uk/sca-extra (MIT licence)"
violation_message: "Two or more blank lines in a row: keep at most one, or format the file with Prettier"
severity: 3
tags: ["Custom", "Regex", "CodeStyle", "DevSecOps"]
file_extensions: [".cls", ".trigger"]
NoSfdocDefaultAuthor:
regex: "/ChangeMeIn@UserSettingsUnder/gi"
description: "The default author of the legacy Salesforce Documenter (SFDoc) extension is not a person. A documentation header names its real author, so replace the default, or remove the header"
violation_message: "Default SFDoc author found: name the real author in the header, or remove the header"
severity: 2
tags: ["Custom", "Regex", "CodeStyle", "DevSecOps"]
file_extensions:
[".cls", ".trigger", ".page", ".component", ".cmp", ".html", ".js"]
NoPolyfillIo:
regex: '/\bpolyfill\.io\b/gi'
description: "Nothing loads from polyfill.io. After the domain changed hands in 2024, the script it served was altered to send visitors to malicious sites. Host the polyfill as a static resource, or remove it"
violation_message: "Reference to polyfill.io found: host the script as a static resource, or remove it"
severity: 2
tags: ["Custom", "Regex", "Security", "DevSecOps"]
file_extensions: [".page", ".component", ".html", ".cmp", ".app", ".xml"]
NoConsoleInVisualforce:
regex: '/(?<!\/\/[^\n]*)\bconsole\.\w+\s*\(/g'
description: "A console statement in a Visualforce page or component can be read by anyone who opens the developer tools of the browser. Remove it"
violation_message: "Console statement found in Visualforce: remove it"
severity: 2
tags: ["Custom", "Regex", "Security", "DevSecOps"]
file_extensions: [".page", ".component"]
VisualforceHeaderComment:
regex: '/^(?!\s*<!--)/g'
description: "A Visualforce page or component starts with a comment that says what it is for. Blank lines may come first"
violation_message: "Start this page or component with a comment that says what it is for"
severity: 4
tags: ["Custom", "Regex", "Documentation", "DevSecOps"]
file_extensions: [".page", ".component"]
eslint:
disable_engine: false
eslint_config_file: eslint.config.js
eslint_ignore_file: null
auto_discover_eslint_config: false
disable_javascript_base_config: false
disable_lwc_base_config: false
disable_slds_base_config: false
disable_typescript_base_config: false
disable_react_base_config: false
file_extensions:
javascript:
- .js
- .cjs
- .mjs
- .jsx
typescript:
- .ts
- .tsx
html:
- .html
- .htm
- .cmp
css:
- .css
- .scss
other: []
flow:
disable_engine: false
python_command: null
pmd:
disable_engine: false
java_command: null
file_extensions:
apex:
- .cls
- .trigger
html:
- .html
- .htm
- .xhtml
- .xht
- .shtml
- .cmp
- .app
javascript:
- .js
- .cjs
- .mjs
typescript:
- .ts
visualforce:
- .page
- .component
xml:
- .xml
java_classpath_entries:
- config/pmd/pmd-java-rules-1.0.0.jar
custom_rulesets:
- rulesets/devsecops-java.xml
- config/pmd/pmd-stock-rules.xml
- config/pmd/pmd-stock-rules-javascript.xml
- config/pmd/pmd-custom-rules-apex.xml
- config/pmd/pmd-custom-rules-markup.xml
- config/pmd/pmd-custom-rules-metadata.xml
- config/pmd/pmd-custom-rules-flow.xml
- config/pmd/pmd-custom-rules-javascript.xml
cpd:
disable_engine: false
java_command: null
file_extensions:
apex:
- .cls
- .trigger
html:
- .html
- .htm
- .xhtml
- .xht
- .shtml
- .cmp
javascript:
- .js
- .cjs
- .mjs
typescript:
- .ts
visualforce:
- .page
- .component
xml:
- .xml
minimum_tokens:
apex: 100
html: 100
javascript: 100
typescript: 100
visualforce: 100
xml: 100
skip_duplicate_files: true
sfge:
disable_engine: false
disable_limit_reached_violations: false
java_command: null
java_max_heap_size: null
java_thread_count: 8
java_thread_timeout: 30000
On the severities in that sample: the severity level assigned to each rule is a suggestion, not a default. Many of these values differ from the severities Code Analyzer ships with; they reflect one opinionated view of how blocking each rule should be. Treat them as a baseline to tune to your own risk tolerance and quality-gate thresholds, and do not assume any given value is the Code Analyzer default. The authoritative defaults come from each engine and the sf code-analyzer config command output.
On the files and the suppressions in that sample: the sample skips only node_modules, so the gate reads every other file of the repository, generated documentation included. Its suppressions section shows a bulk suppression, which turns a rule off for a folder or a file without a comment in the source (Suppress Violations): AvoidJavaScriptUrlHtmlLwcAura in the folders docs/ and doc-assets/, where generated documentation often holds javascript: links. A bulk suppression turns off the whole rule in the folder, not one value, so its max_suppressed_violations caps it: set it to the count the folder has today, and a new violation past it is reported. The sample's cap is 0, so the entry is an example and suppresses nothing.
On the rules the gate runs: the gate runs every rule tagged Recommended and every rule tagged DevSecOps (Running Code Analyzer in GitHub Workflows).
Recommended is Code Analyzer's own tag, and the sample leaves it, and every other tag Code Analyzer ships, exactly as shipped on Code Analyzer's own rules, so the file shows which rules Code Analyzer recommends. DevSecOps is this reference's tag.
The sample adds it to each rule that these standards rely on and that ships without Recommended: {N} rules in all, among them the PMD rules for JavaScript, {N} of Code Analyzer's own PMD rules (AvoidUnauthorizedGetSessionIdInApex, AvoidUnauthorizedApiSessionIdInApex, AvoidUnauthorizedGetSessionIdInVisualforce, AvoidUnauthorizedApiSessionIdInVisualforce, AvoidLmcIsExposedTrue, AvoidLwcBubblesComposedTrue, the {N} rules for scripts and stylesheets in Visualforce, and the {N} rules for hard-coded credentials and for secrets in fields), the Flow rules MissingFaultHandler and UnusedResource, and the ESLint rules curly, no-console, no-implied-eval, and no-script-url.
A rule that the reference wrote carries DevSecOps and not Recommended, because Recommended marks only the rules that Code Analyzer recommends. Code Analyzer tags every rule from a custom ruleset Recommended and Custom by itself, so the sample has an entry for each custom rule that gives it the tags Code Analyzer lists, without Recommended, and DevSecOps. The reference's {N} regex rules are defined with Custom, Regex, a category, and DevSecOps. A tags entry in code-analyzer.yml replaces a rule's whole list of tags, so each entry in the sample repeats the tags the rule ships with and puts DevSecOps last.
A rule that Code Analyzer recommends and that these standards do not want is switched off with disabled: true, and its entry keeps the severity and the tags that Code Analyzer ships it with, with disabled: true after them. In each list of rules, the disabled rules come last, in alphabetical order, as in Code Analyzer's own configuration. Appendix F.6 lists each rule with the standard it enforces.
PMD - Static Analysis¶
Evaluates source against rules spanning security, performance, best practices, error-prone patterns, design quality, and code style. Covers Apex, LWC/JavaScript, Visualforce, and XML metadata.
# Via Code Analyzer
sf code-analyzer run --rule-selector pmd
sf code-analyzer run --rule-selector "pmd:(Security,Performance):(1,2)"
# Standalone, after download and installation, from the root of the repository.
# pmd-all-rules.xml imports the {N} ruleset files; the paths inside it are read from here.
pmd check --rulesets config/pmd/pmd-all-rules.xml --dir force-app --format sarif
Custom rules: PMD supports custom rule authoring in XPath and Java.
XPath rules are the more accessible option for Salesforce teams - they operate directly on the AST of Apex, Visualforce, and XML metadata files without requiring Java compilation. For metadata XML the rules use PMD's DomXPathRule class, which evaluates standard XPath on the document itself; Code Analyzer runs it like any other PMD rule (verified with Code Analyzer 5.16.0).
Java rules are needed where XPath cannot reach: a check that reads another file, such as an Apex class's API version in its -meta.xml, or that needs detail the parser does not expose to XPath, such as the access mode of a DML statement. Code Analyzer loads custom Java rules from a JAR listed under java_classpath_entries in code-analyzer.yml.
The custom XPath rules are provided in Appendix F.2 and the custom Java rules in Appendix F.3.
Adding PMD rules, and who decides their severity: verified on Code Analyzer 5.16.0 (PMD 7.26.0); the runs are kept with the site's source. Six facts govern the setup, and one standard follows from them.
- Rules are added through a ruleset file.
code-analyzer.ymllists each custom ruleset underengines.pmd.custom_rulesets. Every rule in those files, custom or stock, is then selectable by name, and Code Analyzer automatically adds the ruleset's name to the rule as a tag.
The reference's own rulesets, the XPath, JavaScript, and Java ones, all have the name DevSecOps Reference Rules, so every custom PMD rule carries the tag DevSecOpsReferenceRules, and --rule-selector DevSecOpsReferenceRules selects all of them. A regex rule is defined in code-analyzer.yml itself and belongs to no ruleset, so it does not carry this tag. The tag Custom is on every custom rule, regex rules included, and --rule-selector Custom selects them all. Every PMD rule in the sample, custom or stock, also carries the tag of its language. Code Analyzer writes XML, HTML, and JavaScript on its own rules and Xml, Html, and Javascript on a rule of a custom ruleset, and a tag selector ignores case, so --rule-selector XML selects the stock and the custom rules for metadata alike.
Of course, each organisation should rename its PMD rulesets to something more appropriate for that organisation.
2. A stock rule is changed in place. A <rule ref="category/apex/codestyle.xml/MethodNamingConventions"> entry with a <properties> block overrides the stock PMD rule's properties: it stays one rule, under its stock name, with the new behaviour. Giving the reference a new name creates a second rule next to the stock one instead. Properties cannot be set in the YAML file, so this is the only way to change one.
3. Code Analyzer does not read the PMD priority as the severity. It derives a severity from it, and the derivation is lossy and systematic: PMD priority 1 becomes severity 2 (High), priorities 2 and 3 both become severity 3 (Moderate), and priorities 4 and 5 both become severity 4 (Low). A stock PMD rule referenced from a custom ruleset takes the same derivation instead of the severity Code Analyzer ships for it. Under the quality gate's --severity-threshold 2, a priority 2 rule would therefore not block.
4. The YAML has the last word. A rules.pmd.<RuleName>.severity entry in code-analyzer.yml overrides the derived severity: a rule at priority 1 in the XML and severity 5 in the YAML reports at severity 5, while the property override from the XML still applies.
5. When two rulesets define a rule with the same name, the first one listed wins. Code Analyzer runs the rule from the ruleset that comes first under custom_rulesets and drops the other without a warning. PMD on its own runs both, and reports each violation twice. The order of the list is therefore part of the configuration.
6. Two rules that share a name must not be referenced in one ruleset file. PMD ships some rules under one name for two languages: ForLoopsMustUseBraces, IfElseStmtsMustUseBraces, IfStmtsMustUseBraces, and WhileLoopsMustUseBraces each exist for Apex and for JavaScript. Code Analyzer lists the JavaScript rule with the suffix -javascript, but it runs a rule of a custom ruleset by the file and the rule's name, so of two such rules in one file it runs only the first, and it gives no warning. PMD on its own runs both. With the two references in two files, Code Analyzer runs both as well, so a ruleset file references a rule name once, and the stock PMD rules for JavaScript have a file of their own.
The standard: every rule in a custom ruleset, written or referenced, carries an explicit <priority>, and code-analyzer.yml overrides the rule's severity with the same number: priority 1 is severity 1, priority 2 is severity 2, and so on. The XML states the rule author's intent; the YAML makes Code Analyzer honour it. With --severity-threshold 2, priority 1 and priority 2 rules both block the pull request, and priorities 3 to 5 are reported without blocking (Severity Levels sets out the five levels). The threshold may move one day, but the principle that more than one priority blocks does not. The override is needed for every rule, not only when a derived value looks wrong, because the derivation never yields severity 1 and always demotes priority 2.
Regenerating the file with the command above keeps these overrides: sf code-analyzer config --config-file code-analyzer.yml --output-file code-analyzer.yml writes each overridden value back with a # Modified from: comment and keeps the custom_rulesets list. Running sf code-analyzer config without --config-file starts from the defaults and loses every override, so always regenerate from the existing file.
The sample shows this wiring. The sample code-analyzer.yml lists {N} rulesets under custom_rulesets: the Java rules' ruleset, pmd-stock-rules.xml, pmd-stock-rules-javascript.xml, pmd-custom-rules-apex.xml, pmd-custom-rules-markup.xml, pmd-custom-rules-metadata.xml, pmd-custom-rules-flow.xml, and pmd-custom-rules-javascript.xml. No custom rule in one of them shares its name with a rule in another, so their order changes nothing. There are {N} stock rules files because of the sixth fact above: the JavaScript rules are in the second one. It puts the Java rules' JAR on java_classpath_entries, and under rules.pmd it overrides the severity of every rule in those {N} rulesets, stock and custom, with the rule's priority. The sample expects the {N} ruleset files and the JAR in config/pmd/ (The PMD Folder); the rulesets are in Appendix F.
{N} stock rules need the whole project. AvoidInterfaceAsMapKey and UnusedMethod use the Apex Language Server, which loads every class of the project to learn which types implement an interface and which methods are called. The environment variable PMD_APEX_ROOT_DIRECTORY names the folder that holds sfdx-project.json, and without it both rules report nothing and give no warning (tested with Code Analyzer 5.16.0). The sample workflow sets it to the checkout (A.2.9). AvoidInterfaceAsMapKey then reports in a scan of the changed files as well. UnusedMethod reports only on the files of the project itself, so it reports in a scan of the whole repository and not in a scan of the delta package.
Configuration artifact: {N} versioned ruleset files, pmd-stock-rules.xml, pmd-stock-rules-javascript.xml, pmd-custom-rules-apex.xml, pmd-custom-rules-markup.xml, pmd-custom-rules-metadata.xml, pmd-custom-rules-flow.xml, and pmd-custom-rules-javascript.xml, referenced in code-analyzer.yml. Specific rule recommendations are outside the scope of this whitepaper - the reference ruleset in Appendix F.2 is a starting point.
ESLint - LWC Code Quality¶
Surfaces LWC-specific rule violations covering JavaScript quality, component API patterns, accessibility requirements, and Salesforce platform conventions.
# Via Code Analyzer
sf code-analyzer run --rule-selector "eslint:(Recommended,LWC)"
# Standalone, after download and installation
eslint "force-app/**/*.js" --format json
Configuration artifact: eslint.config.js using ESLint's flat configuration format - the default format as of ESLint v9. Projects still using .eslintrc must migrate before upgrading to ESLint v10, where the old format is not recognised. The packages that the file loads, the settings that these standards set, and a sample eslint.config.js are in Version Control: ESLint.
From ESLint to the gate: the Salesforce ESLint packages, Code Analyzer, and code-analyzer.yml each decide something different about a rule, so a rule that stops a commit may not be reported on a pull request. How an ESLint Rule Reaches a Pull Request sets out the three and lists the rules on which they differ.
The SLDS linter: Code Analyzer bundles Salesforce's SLDS linter, the ESLint plugin @salesforce-ux/eslint-plugin-slds, as a dependency of its ESLint engine (version 1.2.1 in Code Analyzer 5.16.0). Its {N} rules carry the Recommended tag, so the gate runs them with no package to install, and the eslint.config.js of these standards does not load it. The package is not in the Version Control table of ESLint packages for that reason.
ESLint documentation: ESLint documentation | ESLint on GitHub
RetireJS - JavaScript Dependency Vulnerability Scanning¶
Scans LWC and Aura component JavaScript, and the JavaScript in static resources, for libraries with known vulnerabilities. The engine ships {N} rules, one per vulnerability severity, and these standards run all {N} (JavaScript: Third-Party Libraries).
# Via Code Analyzer
sf code-analyzer run --rule-selector retire-js
# Standalone, after download and installation
npx retire --path force-app --outputformat json
Flow Analyzer - Declarative Governance¶
Scans Salesforce Flows for anti-patterns, performance issues, and security violations. Requires Python v3.10 or later.
Flow governance is the most commonly neglected dimension of Salesforce static analysis. A Flow with an unbounded loop can exhaust governor limit headroom; an unhandled fault path silently swallows errors; a CRUD/FLS violation bypasses security controls that Apex code is routinely scanned for. Teams not yet ready to address Flow findings should explicitly disable the engine in code-analyzer.yml with a documented re-enablement date.
These standards rely on {N} of the engine's rules (Automation: Flow). DbInLoop reports a Get Records, Create Records, Update Records, or Delete Records element inside a loop; by Code Analyzer's own description, it does not follow a subflow called from the loop. MissingFaultHandler reports a Create Records, Update Records, or Delete Records element, an action, or a subflow that has no fault path. It does not check Get Records, and Code Analyzer ships it without the Recommended tag, which the sample adds. SameRecordUpdate reports an after-save record-triggered Flow that updates the record that triggered it, and follows subflows to find the update. UnusedResource reports a variable that nothing in the Flow uses, and it also ships without the Recommended tag.
CPD - Copy-Paste Detection¶
Identifies duplicated code blocks across the repository. The engine ships one rule per language, six in all: Apex, JavaScript, TypeScript, Visualforce, HTML, and XML. These standards run all six, at the severity 5 they ship at, so a duplicate is reported for the developer's information and never blocks (Apex: Architecture, JavaScript: Duplicated Code, HTML and Visualforce: Duplicated Markup, Metadata Standards: Duplicated Metadata).
# Via Code Analyzer
sf code-analyzer run --rule-selector cpd
# Standalone (CPD ships with the PMD distribution)
pmd cpd --minimum-tokens 100 --dir force-app/main/default/classes --format csv
CPD findings are most useful as a scheduled scan metric and refactoring governance signal rather than a hard PR gate. The --minimum-tokens threshold of 100 avoids flagging unavoidable boilerplate while surfacing meaningful duplication.
Regex Engine - Custom Pattern Detection¶
Allows teams to define custom regular expression rules scanning any file type. Requires no Java or Python prerequisites.
Custom regex rules are defined in code-analyzer.yml itself, under engines.regex.custom_rules, each with its pattern, the file extensions it scans, a description, a violation message, a severity, and tags. There is no separate rules file: the YAML is both the definition and the configuration, and sf code-analyzer config --config-file code-analyzer.yml --output-file code-analyzer.yml keeps the block when the file is regenerated. Use cases include enforcing naming conventions, detecting deprecated API patterns, flagging hardcoded environment-specific strings, or identifying TODO/FIXME comments that should be resolved before merge.
A regex rule sees text, not syntax, so it is the right tool where no engine exposes the thing to check, and a stopgap where PMD will expose it later. Where a PMD rule written in Java can make the check, this reference uses that instead (Choosing Between Them). The {N} custom regex rules of this reference, and the {N} rules that the engine ships, {N} of which these standards adopt and {N} of which they disable, are in Appendix F.4.
sfge Engine - Salesforce Graph Engine (Developer Preview)¶
Performs complex analysis on Apex code and identifies security vulnerabilities and code issues using data flow analysis: it follows each path from an entry point, such as an @AuraEnabled method, to the operation it checks, where PMD reads one class at a time. The engine, and every one of its {N} rules, is in Developer Preview, so a rule may change or go away between versions, and every standard that cites one says so. It needs Java, as PMD does, and a run takes longer than the other engines, because it builds a graph of the whole codebase first.
None of its rules ships with the Recommended tag, so Code Analyzer runs none of them unless a configuration asks. The template ships the engine switched off, and the sample code-analyzer.yml switches it on and tags every one of its rules DevSecOps, so the gate runs them: ApexFlsViolation, AvoidDatabaseOperationInLoop, AvoidMultipleMassSchemaLookups, and DatabaseOperationsMustUseWithSharing at severity 2, ApexNullPointerException at 2, MissingNullCheckOnSoqlVariable at 3, and UnimplementedType at 4. ApexFlsViolation accepts WITH SECURITY_ENFORCED as a check, where these standards reject it: a class that uses it gets one report from NoSecurityEnforced and none from this rule, which is the stricter outcome. At this time, there is no way to create SFCA custom sfge rules.
The engine runs at the gate, as every other engine does. Three things to know: it is in Developer Preview, it needs Java on the runner, and it builds a graph of the whole codebase before it checks anything, so the Code Analyzer run on a pull request takes longer with it than without. The wait buys the findings no other engine makes, a database operation on a without sharing path, a null dereference on the path from an entry point, and a query or DML statement with no permission check on that path, and these standards take them. An organisation whose pull requests cannot carry the time runs the engine on the scheduled scan of the whole codebase instead (A Push, and the Whole Repository on Demand), where a longer run costs nobody a review, and keeps the gate for the other engines. Because the engine is in Developer Preview, an organisation may also choose to switch it off altogether, at the gate and on the scheduled scan; Code Analyzer allows that.
ApexGuru Engine - Remote Apex Analysis¶
Sends Apex classes and triggers to Salesforce's ApexGuru service, which returns performance findings and anti-patterns.
The engine's rules are listed and run only when they are selected by the engine's name, by a rule's name, or by the engine's tag, and never by all or by a severity (rules.ts). In Code Analyzer 5.16.0, as the engine's code reads:
- It needs an org that Salesforce CLI is already logged in to (ApexGuruAuthService.ts). Without one it reports nothing and notes that it was skipped, and the run does not fail (engine.ts).
- It uploads the Apex files it is pointed at to a service that Salesforce hosts (engine.ts, ApexGuruService.ts). Nothing is analysed on the runner.
- Its rule logic is not public: the engine holds a list of rule names and no code that finds a violation (apexguru-rules.ts). Nothing on the runner fixes the set of rules, so the rules can change without a new version of Code Analyzer (engine.ts).
Salesforce describes the engine on its ApexGuru Engine page, which gives it two modes. The mode is the org's, and it cannot be set from the command line or the configuration file.
- Advanced mode, in an org where ApexGuru is activated. ApexGuru is activated in a production org or a full copy sandbox on Unlimited, Enterprise, Professional, or Signature Edition. Its insights then also reach the Developer and Partial Copy sandboxes and the scratch orgs whose Dev Hub is such an org (ApexGuru FAQ). Only this mode has runtime data, such as the methods that use the most CPU time.
- Basic mode, in any other org: a static analysis of the Apex, with no runtime data. It needs no activation.
These standards adopt every one of its {N} rules, at the severities the Apex page gives beside each standard: most sit beside a PMD rule for the same thing, as a second layer, and the rules that only runtime data can find, such as the methods that use the most CPU time, have no other. Salesforce limits the number of scans. The engine page gives 3 a minute for a user, 5 a minute and 100 a day for an org, and 200 a day for the production org and its sandboxes together; the FAQ gives 50 an hour for an org.
An organisation can add the engine to any scan. Its runtime findings come only from an org in advanced mode, so a scheduled scan against such an org, such as production or a full copy sandbox, is where it reports most. On the pull request gate, basic mode adds little beside the PMD rules that the gate already runs, and every scan counts against the limits.
The sample workflows and the sample code-analyzer.yml do not show the engine. An organisation that runs it turns it on itself, in each scan where it wants the engine:
- Select the engine by its name: add
--rule-selector apexguruto the other rule selectors of the scan. A selector such asRecommended,all, or a severity never selects it. - Before the scan, log Salesforce CLI in to the org to scan, as its default org. The engine scans the default org.
UIBundle Engine - Built UI Bundles (Developer Preview)¶
Checks a UI bundle after it is built: the source maps and files in the bundle's dist folder.
The engine's rules run only when they are selected, as ApexGuru's do, and Salesforce's release note calls it a Developer Preview. It judges a built artefact, not source, so with no dist folder it reports nothing (engine.ts). What a UI bundle is, is in the Metadata API Developer Guide. These standards do not rely on it.
Running Code Analyzer in the Editor¶
The Salesforce Code Analyzer extension for Visual Studio Code runs the same engines as the pipeline, from the same code-analyzer.yml, which it finds at the root of the project (Local Checks Before the Push). Its settings decide whether a file is scanned in the editor just as it is in a pull request. They go in .vscode/settings.json:
{
"codeAnalyzer.ruleSelectors": "Recommended DevSecOps",
"codeAnalyzer.analyzeOnSave.enabled": true,
"codeAnalyzer.analyzeOnOpen.enabled": true,
"codeAnalyzer.analyzeAutomatically.fileTypes": ".cls,.js,.apex,.trigger,.ts,.xml,.cmp,.page,.component,.html,.css,.app,.cjs,.mjs",
"codeAnalyzer.includeFixes": true,
"codeAnalyzer.severity 1": "Error",
"codeAnalyzer.severity 2": "Error",
"codeAnalyzer.severity 5": "Info"
}
codeAnalyzer.ruleSelectorschooses the rules that the extension runs when it scans a file. It takes the same selectors as the command line: a tag, an engine, a severity, or the name of a rule, with a space between two of them. Its default isRecommended. The gate runs the rules taggedRecommendedand the rules taggedDevSecOps(Running Code Analyzer in GitHub Workflows), so the setting names both tags, and the editor then runs the rules that a pull request runs. The selectorallruns every rule of every engine instead, about twice as many. The editor then shows more than a pull request will, and a violation that it shows as an error is not always one that blocks.codeAnalyzer.analyzeOnSave.enabledandcodeAnalyzer.analyzeOnOpen.enabledscan a file when it is saved and when it is opened. Both are off by default, and a developer then starts each scan with a command.codeAnalyzer.analyzeAutomatically.fileTypeslists the kinds of file that are scanned on save and on open. Its default is.cls,.js,.apex,.trigger,.ts,.xml, which leaves out Visualforce pages and components, Aura components and applications, HTML templates, stylesheets, and JavaScript module files. The value above adds them. Code Analyzer has rules for each, such as the SLDS rules for stylesheets.codeAnalyzer.includeFixesoffers a fix in the editor for a violation of a rule that has one. It is off by default.codeAnalyzer.severity 1,codeAnalyzer.severity 2, andcodeAnalyzer.severity 5set how the editor shows a violation at each severity. Every severity is a warning by default. With the values above, a violation that blocks a pull request shows as an error, one at severity 3 or 4 as a warning, and one at severity 5 as information.
These are the settings of version 1.22.0 of the extension.
Running Code Analyzer in GitHub Workflows¶
The examples below all use the gate selection these standards recommend, Recommended plus DevSecOps: the rules Code Analyzer recommends, together with the rules this reference adds, which are its own custom rules and the stock rules that ship without the Recommended tag (On the rules the gate runs). Each selector is its own --rule-selector flag, and a rule that matches either one runs. The per-engine selectors earlier on this page demonstrate the syntax; they are not gate configurations.
Action version note: every uses: reference on this page names the version that was current at the time of writing. Where a page references the organisation's own reusable workflows and composite actions by tag, the tag is an immutable release tag; third-party actions are shown at their floating major tag, a choice many organisations make for highly trusted actions such as actions/checkout (the trade-off is explained in Appendix G). Newer major versions may introduce breaking changes: review the release notes for an action before upgrading, and validate in a non-production pipeline before promoting to protected branches. Dependabot and Renovate (Section 7) open PRs when new versions are published, providing a structured upgrade path.
Using the GitHub Action¶
- name: Run Salesforce Code Analyzer
id: run-code-analyzer
uses: forcedotcom/run-code-analyzer@v2
with:
run-arguments: >
--workspace .
--rule-selector Recommended --rule-selector DevSecOps
--severity-threshold 2
--output-file sfca.sarif
- name: Upload SARIF to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: sfca.sarif
# run-code-analyzer@v2 does not auto-fail the workflow.
# Check the exit-code output and fail explicitly.
- name: Fail if blocking violations found
if: steps.run-code-analyzer.outputs.exit-code > 0
run: exit 1
Using the Code Analyzer CLI Directly¶
- name: Install Salesforce CLI
run: |
npm install --global @salesforce/cli
nodeInstallPath=$(npm config get prefix)
echo "$nodeInstallPath/bin" >> $GITHUB_PATH
- name: Install Salesforce CLI Code Analyzer plugin
run: sf plugins install code-analyzer
- name: Run Code Analyzer (JSON and SARIF output)
run: |
sf code-analyzer run \
--config-file code-analyzer.yml \
--workspace . \
--rule-selector Recommended --rule-selector DevSecOps \
--severity-threshold 2 \
--output-file ./code-analyzer/code-analyzer-results.json \
--output-file ./code-analyzer/sfca.sarif
# The run fails the job on a violation at severity 1 or 2, after it writes
# both files. always() uploads and reports the violations that failed it.
- name: Upload SARIF to GitHub Code Scanning
if: always()
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: code-analyzer/sfca.sarif
- name: Parse and post PR comment
if: always()
run: |
BLOCKING=$(jq '[.violations[] | select(.severity <= 2)] | length' code-analyzer/code-analyzer-results.json)
NON_BLOCKING=$(jq '[.violations[] | select(.severity > 2)] | length' code-analyzer/code-analyzer-results.json)
# Construct and post structured PR comment and workflow output
# from $BLOCKING and $NON_BLOCKING counts and their entries
Delta-Scoped Analysis with sfdx-git-delta¶
The recommended approach for differential scanning is sfdx-git-delta (GitHub), which generates a clean deployment-ready delta of changed metadata and is more robust than passing a raw list of changed file paths. The full reusable workflow that wraps this step and uploads the result as a GitHub Actions artifact is in Appendix A.2.8.
- name: Install CLI and plugins
run: |
npm install --global @salesforce/cli
mkdir -p ~/.config/sf
echo '["sfdx-git-delta", "code-analyzer"]' > ~/.config/sf/unsignedPluginAllowList.json
sf plugins install sfdx-git-delta
sf plugins install code-analyzer
- name: Generate delta package
run: |
mkdir -p delta
sf sgd source delta \
--from ${{ github.event.pull_request.base.sha }} \
--to ${{ github.event.pull_request.head.sha }} \
--output-dir delta \
--generate-delta
- name: Check for deployable metadata
id: check-delta
run: |
if grep -q '<types>' delta/package/package.xml 2>/dev/null; then
echo "has-metadata=true" >> $GITHUB_OUTPUT
else
echo "---- No changes to analyze ----"
echo "has-metadata=false" >> $GITHUB_OUTPUT
fi
- name: Run Code Analyzer on delta only
if: steps.check-delta.outputs.has-metadata == 'true'
run: |
sf code-analyzer run \
--workspace delta \
--rule-selector Recommended --rule-selector DevSecOps \
--severity-threshold 2 \
--output-file results.json
sfdx-git-delta also generates package.xml and destructiveChanges.xml manifests: the destructive changes manifest feeding into the destructive change detection gate (Section 6), and the package.xml feeding into sf project deploy. The full reusable workflow that consumes the delta artifact and runs deployment validation is in Appendix A.2.12.
A Push, and the Whole Repository on Demand¶
The push baseline scans a delta package as a pull request does, and it builds the delta package itself, in the same job (Appendix A.2.9). The delta runs from the commit before the push to the new commit, so that it holds every commit of the push. --from "HEAD~1" would hold the last commit only.
No push scans the whole repository. That scan is slow in a large repository, and it would report the violations of old code on every push. The whole repository is scanned every week, in the weekly project scan (Appendix A.1.5), and when a person starts the scan (Appendix A.1.7), and each scan stores every violation as a CSV file, a JSON file, and a SARIF file in one artifact:
# What a push changed, as the push baseline does it. BEFORE is the commit before the push
mkdir -p delta
sf sgd source delta --from "$BEFORE" --to HEAD --generate-delta --output-dir delta
sf code-analyzer run --workspace delta \
--rule-selector Recommended --rule-selector DevSecOps --output-file results.json
# The whole repository, as the scan on demand does it
sf code-analyzer run --workspace . --rule-selector Recommended --rule-selector DevSecOps \
--output-file results.csv --output-file results.json --output-file results.sarif