Scan Apex, triggers and Flows with Code Analyzer

Overview

Code Analyzer is static analysis of Apex, triggers and Flows against a rule catalog you can read and tune. It goes further than a per-file linter: it follows method calls out of a loop to find SOQL or DML that is reached from that loop, and it detects re-entrancy cycles that span Apex and Flow.

The page has three tabs:

• Findings — what the selected scan found, worst first.
• Rules — which rules are in scope, which run, and how they are tuned.
• Scans — history, and what changed between two scans.

Rules are data, not code. Changing a severity or threshold is a save, not a deploy, and each scan records the rule configuration version it ran with.

Before you start

• The org must be synced. A scan reads the metadata MetaLens360 fetched during the last sync.
• Anyone in the workspace can view findings and rules.
• Running or deleting a scan needs the sync.run permission (every role except Viewer by default).
• Tuning rules and rule packs needs settings.manage (Admin and Architect by default).

Steps

1. Open Code Analyzer under Code & Performance Analysis.
2. Pick the org from the org dropdown.
3. Click Run scan. The button shows Starting… and then Scan running… while it works.
4. When the scan finishes, stay on the Findings tab. Filter by category, kind, rule or severity.
5. Expand a finding to see the call chain or cycle path, then click View code to open the source at the cited line.
6. If a rule is too noisy for your codebase, click Tune this rule to jump to it on the Rules tab.
7. On the Rules tab, use Choose packs to pick the active rule packs, and Search rules to find a rule.
8. Expand a rule to read Why this rule exists, then adjust Severity, Parameters or Exclusions ("Class, file or object to silence").
9. Click Save changes (or Discard). Run a new scan to apply the change.

Example

Priya, a release manager, runs a scan on acme-uat and sees a critical finding: a query inside AccountService.loadContacts() is reached from a loop in AccountTrigger, two calls down. She clicks View code, confirms it, and the developer moves the query out of the loop. After the fix she runs another scan, opens Scans, clicks Compare two scans, picks the earlier run as Baseline and the new one as Scan to compare, and sees the finding under Resolved.

FAQs

Why did severity drop for some loop findings?

Severity is earned by where the code sits. The further a query is below the loop, the more likely something in between already guards or batches it, so the finding is graded lower. Nothing is hidden — it is ranked more honestly.

Are test classes scanned?

Test code is excluded by default, because test data setup never sees a production batch size.

What do the filters on the Rules tab do?

The show filter lets you list All, Enabled, Disabled, Customised, Conflicts, With findings or Out of scope rules. Activate all and Deactivate all ask for confirmation first.

How do I undo my tuning?

Expand the rule and click Reset this rule to its shipped defaults.

Troubleshooting

"No scan has been run yet."

Nothing has been analysed for this org, so this is not a clean result. Click Run the first scan.

The scan fails with "No fetched metadata is available for <org>"

The org has never been synced, or the sync fetched nothing. Run an org sync first, then scan again.

A warning says not every rule ran

A rule skipped for lack of a detector, or a cross-org rule run against one org, is reported as skipped — not as clean. When everything ran you see "Every enabled rule ran in this scan."

I want to remove an old scan

On Scans, delete it. You are asked "Delete this scan?" — choose Delete scan, or Keep it to cancel.

Related articles

• Run your first sync
• SOQL Risk Intelligence
• Flow Health Analysis
• Roles and permissions