Salesforce Code Scan

The Salesforce Code Scan Tool performs static analysis of Apex code to identify security risks, anti-patterns, and maintainability issues before deployment. It parses Apex sources, analyzes patterns that commonly lead to SOQL/SOSL injection, governor-limit violations, and brittle code structure, and then reports findings with risk scores. It provides remediation guidance tailored to Salesforce best practices and platform constraints. It benefits developers, security engineers, and release teams by enabling early defect discovery and consistent review metrics. The tool distinguishes Salesforce-specific checks from generic patterns and supports per-file and aggregate reports to guide targeted refactoring and secure coding.
Conceptually, the analysis combines lexical parsing, rule-sets, and heuristic scoring to quantify risk. It evaluates code for patterns such as dynamic SOQL, unchecked user input, improper sharing, and inefficient queries, then correlates these with test coverage and package dependencies. The result is a prioritized snapshot of issues, recommended fixes, and a historical view when connected to a repository over time. The unique value lies in Salesforce-centric rule coverage, ready-to-use remediation guidance, and easy export for CI/CD pipelines.
Core features include an Apex parser, rule engine, vulnerability detectors, governor-limit detectors, maintainability metrics, and per-file plus summary reports; advanced users can customize rule sets and integrate scans into build pipelines.