Explore Salesforce Code Analyzer
Learning Objectives
After completing this unit, you’ll be able to:
- Identify the key features of Salesforce Code Analyzer.
- Describe each of the seven prebundled rule engines and their purposes.
- Explain how to install and set up the Salesforce Code Analyzer extension in Visual Studio Code.
What Is Salesforce Code Analyzer?
Maintaining consistency across a development team and keeping security vulnerabilities out of production can feel like a constant uphill battle. That’s exactly where Salesforce Code Analyzer comes into the picture.
Instead of relying on manual code reviews or waiting for errors to pop up during testing, Salesforce Code Analyzer evaluates your source code directly without executing it. This process, known as static code analysis, allows you to scan your application for code quality issues, formatting issues, and performance bottlenecks before you deploy a single line of code.
Salesforce Code Analyzer is a unified, multi-language static code analysis tool with 700+ built-in rules that:
- Detects security vulnerabilities such as SOQL injection.
- Identifies code quality issues such as repetitive code from copy-paste activities.
- Enforces coding standards consistently across teams such as banning trailing whitespaces.
- Improves performance by spotting bottlenecks before they impact users.
The tool adapts to your workflow, whether you prefer using CLI commands for automation and CI/CD integration, or the Visual Studio (VS) Code extension for real-time feedback while coding. It features broad language support, works natively with Apex, JavaScript, TypeScript, Visualforce, and more. You can easily customize the 700+ built-in rules or create rules for organization-specific patterns.
Rule Engines
Code Analyzer doesn't work alone—it uses multiple specialized rule engines, each designed to catch different types of issues. Think of these engines as expert reviewers, each with an area of expertise. These engines work simultaneously during a scan, each analyzing your code through its specialized lens.
Rule Engine |
Description |
|---|---|
CPD |
Identifies blocks of duplication across files |
ESLint |
Evaluates JavaScript, TypeScript, and React component code |
Flow Scanner |
Audits Salesforce Flows and reports detailed information about security issues |
PMD |
Performs static analysis of code written in a number of supported languages, such as Apex and Visualforce and PMD AppExchange rules |
RetireJS |
Analyzes a project’s third-party JavaScript dependencies and identifies security vulnerabilities |
Regex |
Uses regular expressions (regex) to search your code base for patterns |
Salesforce Graph Engine |
Performs complex analysis on Apex code and identifies security vulnerabilities and code issues |
Set Up Your Environment
Before you scan your code, install Salesforce Code Analyzer. Here’s the setup process.
Prerequisites
To complete the work in this badge, you need these tools on your computer.
-
Visual Studio Code (VSCode) in the Salesforce DX environment
-
Salesforce CLI in the Salesforce DX environment
-
Salesforce Extensions Pack for Visual Studio Code
- Node.js (version 18 or later)
- Java Runtime Environment (JRE) version 11 or later (strictly required for PMD and Graph Engine)
Install the Visual Studio Code Extension
The Salesforce Code Analyzer VS Code extension integrates many of Code Analyzer’s most useful features into VS Code, so that you can run them easily with clicks instead of terminal CLI commands.
The VS Code extension gives you immediate feedback while you type, catching violations before you even save your files.
- Open Visual Studio Code.
- Select the Extensions icon on the left sidebar, or press Cmd+Shift+X (macOS) or Ctrl+Shift+X (Windows).
- In the extension marketplace search box, enter
Salesforce Code Analyzer.
- Select Install.
After installation completes, reload VS Code if prompted.
Installation is complete and your environment is ready. In the next unit, you’ll run your first scan to see the system in action.