What is Salesforce Code Analyzer?<\/h2>\n\n\n\n
Salesforce Code Analyzer is a Salesforce CLI plugin and VS Code extension that runs static analysis on your project. Static analysis means it reads the code without running it. Each engine brings rules, and each rule reports a violation with a file, a line, a severity and a link to help.<\/p>\n\n\n\n
Think of a spell checker for code. It does not know your story, but it underlines words that look wrong and explains why. You still decide what to fix, but you miss far fewer mistakes.<\/p>\n\n\n\n
Why Salesforce Code Analyzer Matters<\/h2>\n\n\n\n
Manual reviews miss things, especially in large projects. Here is why Salesforce Code Analyzer matters at Bright Path Tutors.<\/p>\n\n\n\n
- \n
- First, it flags classes that run queries without a sharing declaration.<\/li>\n\n
- Also, it finds DML and SOQL that skip CRUD and FLS checks.<\/li>\n\n
- Next, it spots SOQL and DML inside loops before they hit governor limits.<\/li>\n\n
- AppExchange partners must scan code before security review.<\/li>\n\n
- Finally, it runs in CI, so every pull request gets the same checks.<\/li>\n<\/ul>\n\n\n\n
So the scanner acts as a tireless first reviewer for every change.<\/p>\n\n\n\n
How Salesforce Code Analyzer Works<\/h2>\n\n\n\n
Salesforce Code Analyzer follows a clear flow. First, you choose which files to scan with –target, or the whole project. Next, you pick rules with –rule-selector, such as Recommended or Security. Then each engine, such as PMD, ESLint or Flow Scanner, checks the files against its rules. After that, Code Analyzer collects every violation with a severity from 1 (Critical) to 5 (Info). Finally, it shows a table in the terminal or writes a report file, such as HTML, JSON or SARIF.<\/p>\n\n\n\n
![\"Salesforce](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/salesforce-code-analyzer-pmd-diagram-1-1024x640.png\")
How a Code Analyzer scan produces its report.<\/figcaption><\/figure>\n\n\n\n Engines<\/h3>\n\n\n\n
PMD checks Apex and Visualforce. ESLint checks JavaScript and LWC. Retire.js finds old libraries with known problems. Flow Scanner checks flows, Regex runs pattern rules, and CPD finds copied code.<\/p>\n\n\n\n
Rule Selectors<\/h3>\n\n\n\n
The –rule-selector flag picks rules by engine, tag or severity. For example,
pmd:Security<\/code> selects PMD security rules, andRecommended<\/code> selects the default set.<\/p>\n\n\n\nSeverities<\/h3>\n\n\n\n
Severities run from 1 (Critical) to 5 (Info). Fix 1 and 2 first, and decide team rules for the rest.<\/p>\n\n\n\n
Configuration File<\/h3>\n\n\n\n
A code-analyzer.yml file in the project changes rule severities, turns engines off, or adds tags. Run
sf code-analyzer config<\/code> to generate a starting file.<\/p>\n\n\n\nSuppressions<\/h3>\n\n\n\n
When a violation is a false alarm, you can suppress it in code, for example with @SuppressWarnings(‘PMD.ApexCRUDViolation’). Always add a comment that explains why.<\/p>\n\n\n\n
Common PMD Rules for Apex<\/h2>\n\n\n\n
The table below lists rules you will see often in Apex projects.<\/p>\n\n\n\n
Rule<\/th> What it flags<\/th><\/tr><\/thead> ApexCRUDViolation<\/td> SOQL or DML without CRUD and FLS checks or user mode<\/td><\/tr> ApexSharingViolations<\/td> Classes with SOQL or DML but no sharing keyword<\/td><\/tr> ApexSOQLInjection<\/td> Dynamic SOQL built from untrusted input<\/td><\/tr> ApexXSSFromURLParam<\/td> URL parameters used without escaping<\/td><\/tr> OperationWithLimitsInLoop<\/td> SOQL, DML or similar calls inside loops<\/td><\/tr> ApexUnitTestClassShouldHaveAsserts<\/td> Test methods with no asserts<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Code Analyzer vs Manual Code Review<\/h2>\n\n\n\n
The table below compares the scanner with a human reviewer.<\/p>\n\n\n\n
Feature<\/th> Salesforce Code Analyzer<\/th> Manual code review<\/th><\/tr><\/thead> Speed<\/td> Seconds for a project<\/td> Hours for a big change<\/td><\/tr> Consistency<\/td> Same rules every time<\/td> Depends on the reviewer<\/td><\/tr> Business logic bugs<\/td> Rarely found<\/td> Often found<\/td><\/tr> False alarms<\/td> Some<\/td> Few<\/td><\/tr> Best at<\/td> Known patterns and rules<\/td> Design and intent<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n When to use which is easy. Use both. Let Code Analyzer catch known patterns first, so reviewers can focus on design and business rules.<\/p>\n\n\n\n
![\"Salesforce](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/salesforce-code-analyzer-pmd-diagram-2-1024x640.png\")
Code Analyzer vs manual code review.<\/figcaption><\/figure>\n\n\n\n A Real Salesforce Code Analyzer Example<\/h2>\n\n\n\n
Let’s run Salesforce Code Analyzer on the Bright Path Tutors project in VS Code’s terminal.<\/p>\n\n\n\n
Step 1: Install the Plugin<\/h3>\n\n\n\n
sf plugins install @salesforce\/plugin-code-analyzer\nsf code-analyzer rules --rule-selector \"pmd:Security\"<\/code><\/pre>\n\n\n\nThe first command installs or updates the plugin. The second lists the PMD security rules, so you can see what will run.<\/p>\n\n\n\n
Step 2: Scan a Class<\/h3>\n\n\n\n
Here is an old class that the scanner should flag.<\/p>\n\n\n\n
public class CourseSearch {\n public static List<Course__c> find(String text) {\n return Database.query('SELECT Id FROM Course__c WHERE Name = \\'' + text + '\\'');\n }\n}<\/code><\/pre>\n\n\n\nThe class has no sharing keyword and builds a query from raw text. Now run the scan.<\/p>\n\n\n\n
sf code-analyzer run --target force-app\/main\/default\/classes\/CourseSearch.cls --rule-selector Security --view detail<\/code><\/pre>\n\n\n\nStep 3: Read the Results<\/h3>\n\n\n\n
Here is a shortened version of the output.<\/p>\n\n\n\n
=== 1. ApexSOQLInjection\n severity: 2 (High)\n engine: pmd\n location: force-app\/main\/default\/classes\/CourseSearch.cls (3:16)\n=== 2. ApexSharingViolations\n severity: 3 (Moderate)\n engine: pmd\n location: force-app\/main\/default\/classes\/CourseSearch.cls (1:1)<\/code><\/pre>\n\n\n\nBoth problems from the Level 6 posts show up. So the fix is to add with sharing and use a bind variable with user mode, then scan again until the list is empty.<\/p>\n\n\n\n
Step 4: Add It to CI<\/h3>\n\n\n\n
sf code-analyzer run --rule-selector Recommended --severity-threshold 2 --output-file results.sarif<\/code><\/pre>\n\n\n\nThe –severity-threshold flag makes the command fail when it finds violations of severity 2 or worse. So a CI job can block a pull request, and the SARIF file can show results in tools such as GitHub code scanning.<\/p>\n\n\n\n
Salesforce Code Analyzer in VS Code<\/h2>\n\n\n\n
The Salesforce Code Analyzer extension for VS Code scans files as you work. It underlines violations in the editor and shows them in the Problems panel. So you can fix issues before you even commit.<\/p>\n\n\n\n
Common Mistakes with Salesforce Code Analyzer<\/h2>\n\n\n\n
- \n
- Running it only once before release instead of on every change.<\/li>\n\n
- Suppressing violations without a written reason.<\/li>\n\n
- Treating every finding as equal instead of fixing high severities first.<\/li>\n\n
- Using an old version of the plugin with outdated rules.<\/li>\n\n
- Assuming a clean scan means the code is fully secure.<\/li>\n<\/ul>\n\n\n\n
Best Practices for Salesforce Code Analyzer<\/h2>\n\n\n\n
- \n
- Run it locally in VS Code and again in CI.<\/li>\n\n
- Fail builds on severity 1 and 2 findings.<\/li>\n\n
- Keep a shared code-analyzer.yml in the repository.<\/li>\n\n
- Review suppressions during code review.<\/li>\n\n
- Update the plugin regularly to get new rules.<\/li>\n<\/ul>\n\n\n\n
Practice Task<\/h2>\n\n\n\n
Run
sf code-analyzer run --rule-selector Recommended --output-file results.html<\/code> on your project and open the HTML report. Then fix the three highest-severity findings. Hint: sort by severity and start with Security tags.<\/p>\n\n\n\nMost Asked Interview Questions on Salesforce Code Analyzer<\/h2>\n\n\n\n
Teams expect developers to know their quality tools. Here are the 21 questions asked most about Salesforce Code Analyzer.<\/p>\n\n\n\n
Basic Questions on Salesforce Code Analyzer<\/h3>\n\n\n\n
Q1: What is Salesforce Code Analyzer?<\/strong><\/p>\n\n\n\n
A CLI plugin and VS Code extension that scans Salesforce code with engines such as PMD and ESLint.<\/p>\n\n\n\n
Q2: What is static analysis?<\/strong><\/p>\n\n\n\n
Checking code for problems by reading it, without running it.<\/p>\n\n\n\n
Q3: Which engine checks Apex?<\/strong><\/p>\n\n\n\n
PMD, along with others such as Regex and CPD.<\/p>\n\n\n\n
Q4: How do you install the plugin?<\/strong><\/p>\n\n\n\n
Run sf plugins install @salesforce\/plugin-code-analyzer.<\/p>\n\n\n\n
Q5: Which command runs a scan?<\/strong><\/p>\n\n\n\n
sf code-analyzer run.<\/p>\n\n\n\n
Q6: What do severities mean?<\/strong><\/p>\n\n\n\n
They rank findings from 1 (Critical) to 5 (Info).<\/p>\n\n\n\n
Q7: Which rule flags missing sharing keywords?<\/strong><\/p>\n\n\n\n
ApexSharingViolations.<\/p>\n\n\n\n
Code and Scenario Questions on Salesforce Code Analyzer<\/h3>\n\n\n\n
Q8: How do you scan only security rules?<\/strong><\/p>\n\n\n\n
Use –rule-selector Security, or an engine-specific selector such as pmd:Security.<\/p>\n\n\n\n
Q9: How do you scan a single file or folder?<\/strong><\/p>\n\n\n\n
Use the –target flag with the path.<\/p>\n\n\n\n
Q10: How do you save results to a file?<\/strong><\/p>\n\n\n\n
Use –output-file with an extension such as .html, .json, .csv or .sarif.<\/p>\n\n\n\n
Q11: How do you make CI fail on serious findings?<\/strong><\/p>\n\n\n\n
Use –severity-threshold, for example 2, so the command exits with an error.<\/p>\n\n\n\n
Q12: Which rule flags queries in loops?<\/strong><\/p>\n\n\n\n
OperationWithLimitsInLoop.<\/p>\n\n\n\n
Q13: How do you suppress a false alarm?<\/strong><\/p>\n\n\n\n
Use @SuppressWarnings with the PMD rule name, and add a comment explaining why.<\/p>\n\n\n\n
Q14: How do you change a rule’s severity for your team?<\/strong><\/p>\n\n\n\n
Set it in code-analyzer.yml.<\/p>\n\n\n\n
Advanced Questions on Salesforce Code Analyzer<\/h3>\n\n\n\n
Q15: Why is a clean scan not proof of security?<\/strong><\/p>\n\n\n\n
Scanners find known patterns but miss business logic and design flaws.<\/p>\n\n\n\n
Q16: What is the Flow Scanner engine for?<\/strong><\/p>\n\n\n\n
It checks flows for issues such as unsafe data paths and bad practices.<\/p>\n\n\n\n
Q17: What is SARIF?<\/strong><\/p>\n\n\n\n
A standard format for static analysis results that many CI and code hosting tools understand.<\/p>\n\n\n\n
Q18: Why is Code Analyzer important for AppExchange partners?<\/strong><\/p>\n\n\n\n
Partners scan code as part of preparing for security review.<\/p>\n\n\n\n
Q19: How do you roll out Code Analyzer on a large old project?<\/strong><\/p>\n\n\n\n
Start with high severities, fix or document them, then tighten the threshold over time.<\/p>\n\n\n\n
Q20: What does CPD find?<\/strong><\/p>\n\n\n\n
Copy-pasted code blocks, which are harder to maintain.<\/p>\n\n\n\n
Q21: Where should the scanner run in a team workflow?<\/strong><\/p>\n\n\n\n
In VS Code while coding, and in CI on every pull request.<\/p>\n\n\n\n
Official Resources<\/h2>\n\n\n\n