Detect unsafe contexts, queries in loops, hardcoded IDs, and more to optimize Salesforce Flows

---

Table of contens

• Usage
  • Examples
• Configuration
  • Scanner Options
• Installation
• Development

---

Usage

Lightning Flow Scanner CLI is plug-and-play. Open any project with flows and run sf flow:scan; all default rules and thresholds are applied automatically.

sf flow:scan [options]

Customize the scan behavior using the following options:

Flag	Alias	Description	Example
--config	-c	Path to the configuration file	-c ./dir/flow-scanner.json
--directory	-d	Directory to scan recursively	-d ./force-app/main/
--files	-p	Space-separated list of specific flow files to scan	-p "flow1.flow-meta.xml" "flows/flow2.flow-meta.xml"
--sarif	-s	Output results in SARIF format to stdout	--sarif > results.sarif
--threshold	-t	Fail the run on errors of this level or higher (error|warn|info)	--threshold warn
--betamode	-z	Enable experimental beta rules	--betamode
--json		Output results as pretty-printed JSON	--json
--loglevel		Logging verbosity trace | debug | info | warn | error | fatal [default: warn]	--loglevel debug

Privacy: Zero user data collected. All processing is client-side. → See our Security Policy.

Examples

Quick local scan with JSON output

sf flow:scan -d ./flows --json

CI/CD ready with SARIF

sf flow:scan -d src/flows --sarif > report.sarif

Scan only two specific flows including beta rules

sf flow:scan -p "flows/Opportunity_Auto_Approve.flow-meta.xml" "flows/Case_Escalation.flow-meta.xml" -z --json

---

Configuration

It is recommended to set up a .flow-scanner.yml and define:

• The rules to be executed.
• The severity of violating any specific rule.
• Rule properties such as REGEX expressions.
• Any known exceptions that should be ignored during scanning.

Scanner Options

{
  "rules": {
    // Your rules here
  },
  "exceptions": {
    // Your exceptions here
  },
  "betamode": false // Enable beta rules
}

Using the rules section of your configurations, you can specify the list of rules to be run. Furthermore, you can define the severity and configure expressions of rules. Below is a breakdown of the available attributes of rule configuration:

{
  "rules": {
    "<RuleName>": {
      "severity": "<Severity>",
      "expression": "<Expression>"
    }
  }
}

Note: if you prefer JSON format, you can create a .flow-scanner.json file using the same format. For a more on configurations, review the scanner documentation.

---

Installation

Install with sf (Salesforce CLI)	Install globally with npm
sf plugins install lightning-flow-scanner	npm install -g lightning-flow-scanner

---

Development

This project optionally uses Volta to manage Node.js versions. Install Volta with:

curl https://get.volta.sh | bash

Volta will automatically use the Node.js version defined in package.json.

1. Clone the repository

  git clone https://github.com/Flow-Scanner/lightning-flow-scanner-cli.git

2. Install Dependencies

  npm install

3. Build Executables

  npm run build

4. Run Tests

  npm run test

5. Linking SF CLI Plugin to test changes locally, run:

  sf plugins link .

6. Linking Core Module (Optional)

If you’re developing or testing updates to the core module, run:

• In the core module directory, run:

  npm run link

• In this CLI project directory, run:

  npm link @flow-scanner/lightning-flow-scanner-core

Want to help improve Lightning Flow Scanner? See our Contributing Guidelines