CodeScan

Start by wiring CodeScan into your Salesforce workflow, not the other way around. Connect your GitHub, GitLab, or Bitbucket repository, pick the Salesforce assets you want scanned (Apex, LWC, Visualforce, SOQL, metadata), and load a starter rule set for readability, reliability, and security. Tune thresholds to your team’s tolerance: cap cyclomatic complexity, require naming patterns, and set minimum test coverage gates. Establish a baseline so existing issues don’t block day‑one progress, and focus enforcement on new and changed code. Schedule nightly full scans, enable on‑push analysis, and decorate pull requests with summaries, hotspots, and links back to detailed findings.

Keep developers productive by shifting checks left. Use the VS Code extension or CLI to scan locally before committing; highlight problems inline with quick explanations, examples, and recommended fixes. Catch common pitfalls early—CRUD/FLS gaps, SOQL injection, unguarded DML in loops, inefficient queries, and risky sharing configurations. If an exception is warranted, add an approved suppression with a justification so reviewers understand the context. Add a pre‑commit or pre‑push hook to block code that violates critical rules, and surface a clear message that points to the exact file, line, and rule so engineers can resolve issues in minutes, not days.

Automate quality in CI/CD. Drop a CodeScan step into GitHub Actions, Jenkins, Azure DevOps, Bitbucket Pipelines, or GitLab CI. Run fast delta scans on changed files for quick feedback, then perform full scans on main during release builds. Fail the pipeline on blocker or critical violations, or when quality gates slip below target. Decorate pull requests with inline comments for the most important findings and publish artifacts (SARIF/HTML/PDF) for auditors and managers. Gate merges on passing quality checks, and export a clean, shareable report with rule IDs, severity, remediation guidance, and time‑to‑fix estimates. For unlocked packages and multi‑module repos, scan each package independently and require each to meet its gate before promotion.

Close the loop with security and governance. Align checks to OWASP Top 10 and SANS/CWE so security teams can map findings to policy. Use dashboards to track trends, new‑code cleanliness, and hotspots by repository, team, or rule. Assign owners, set SLAs per severity, and route alerts to Slack, Teams, or email. Create rule profiles for different teams—strict for platform core, flexible for prototypes—and lock them with branch protection so standards don’t drift. When incidents happen, filter to exploitable issues first, prioritize by risk, and generate an audit‑ready report in minutes. Over time, measure reduced rework, faster reviews, and steadier releases as clean code becomes the default path.