@flow-scanner/lightning-flow-scanner-core 6.14.0 → 6.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/README.md +206 -212
  2. package/main/libs/ExportDetails.js +2 -1
  3. package/main/libs/ExportSarif.js +3 -3
  4. package/main/libs/ScanFlows.js +4 -0
  5. package/main/models/FlatViolation.d.ts +1 -0
  6. package/main/models/RuleResult.d.ts +1 -0
  7. package/main/models/RuleResult.js +1 -0
  8. package/main/rules/APIVersion.js +1 -1
  9. package/main/rules/ActionCallsInLoop.js +2 -2
  10. package/main/rules/AutoLayout.js +1 -1
  11. package/main/rules/CopyAPIName.js +1 -1
  12. package/main/rules/CyclomaticComplexity.js +1 -1
  13. package/main/rules/DMLStatementInLoop.js +1 -1
  14. package/main/rules/DuplicateDMLOperation.js +1 -1
  15. package/main/rules/FlowDescription.js +1 -1
  16. package/main/rules/FlowName.js +1 -1
  17. package/main/rules/GetRecordAllFields.js +1 -1
  18. package/main/rules/HardcodedId.js +1 -1
  19. package/main/rules/HardcodedUrl.js +1 -1
  20. package/main/rules/InactiveFlow.js +1 -1
  21. package/main/rules/MissingFaultPath.js +1 -1
  22. package/main/rules/MissingMetadataDescription.js +2 -2
  23. package/main/rules/MissingNullHandler.js +1 -1
  24. package/main/rules/MissingRecordTriggerFilter.js +1 -1
  25. package/main/rules/ProcessBuilder.js +3 -1
  26. package/main/rules/RecordIdAsString.js +2 -2
  27. package/main/rules/RecursiveAfterUpdate.js +1 -1
  28. package/main/rules/SOQLQueryInLoop.js +1 -1
  29. package/main/rules/SameRecordFieldUpdates.js +1 -1
  30. package/main/rules/TransformInsteadOfLoop.js +1 -1
  31. package/main/rules/TriggerOrder.js +1 -1
  32. package/main/rules/UnconnectedElement.js +1 -1
  33. package/main/rules/UnsafeRunningContext.js +1 -1
  34. package/main/rules/UnusedVariable.js +1 -1
  35. package/package.json +1 -1
package/README.md CHANGED
@@ -33,10 +33,10 @@
33
33
 
34
34
  - **[Default Rules](#default-rules)**
35
35
  - **[Configuration](#configuration)**
36
- - [Configure Severity Levels](#configure-severity-levels)
36
+ - [Configure Rules](#configure-rules)
37
37
  - [Overwrite Expressions](#overwrite-expressions)
38
38
  - [Define Exceptions](#define-exceptions)
39
- - [Exclude Flows from Scanning](#exclude-flows-from-scanning)
39
+ - [Exclude Flows](#exclude-flows)
40
40
  - [Scan Modes](#scan-modes)
41
41
  - **[Installation](#installation)**
42
42
  - [Distributions](#distributions)
@@ -53,195 +53,195 @@
53
53
 
54
54
  > Want to code a new rule? → See [How to Write a Rule](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/docs/write-a-rule.md)
55
55
 
56
- <!-- START GENERATED_RULES -->
57
- ### Action Call In A Loop
58
- To prevent exceeding Apex governor limits, it is advisable to consolidate and bulkify your apex calls, utilizing a single action call containing a collection variable at the end of the loop.
59
-
60
- **Rule ID:** `action-call-in-loop`
61
- **Class Name:** _[ActionCallsInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/ActionCallsInLoop.ts)_
62
- **Severity:** 🔴 *Error*
63
-
64
- ### DML Statement In A Loop
65
- To prevent exceeding Apex governor limits, consolidate all your database operations—record creation, updates, or deletions—at the conclusion of the flow.
66
-
67
- **Rule ID:** `dml-in-loop`
68
- **Class Name:** _[DMLStatementInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/DMLStatementInLoop.ts)_
69
- **Severity:** 🔴 *Error*
70
-
71
- ### Duplicate DML Operation
72
- When a flow executes database changes or actions between two screens, prevent users from navigating backward between screens; otherwise, duplicate database operations may be performed.
73
-
74
- **Rule ID:** `duplicate-dml`
75
- **Class Name:** _[DuplicateDMLOperation](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/DuplicateDMLOperation.ts)_
76
- **Severity:** 🟡 *Warning*
77
-
78
- ### Excessive Cyclomatic Complexity
79
- The number of loops and decision rules, plus the number of decisions. Use a combination of 1) subflows and 2) breaking flows into multiple concise trigger ordered flows, to reduce the cyclomatic complexity within a single flow, ensuring maintainability and simplicity.
80
-
81
- **Rule ID:** `excessive-cyclomatic-complexity`
82
- **Class Name:** _[CyclomaticComplexity](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/CyclomaticComplexity.ts)_
83
- **Severity:** 🔵 *Note*
84
-
85
- ### Flow Naming Convention
86
- The readability of a flow is paramount. Establishing a naming convention significantly enhances findability, searchability, and overall consistency. Include at least a domain and a brief description of the flow’s actions, for example `Service_OrderFulfillment`.
87
-
88
- **Rule ID:** `invalid-naming-convention`
89
- **Class Name:** _[FlowName](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/FlowName.ts)_
90
- **Severity:** 🔴 *Error*
91
-
92
- ### Get Record All Fields
93
- Following the principle of least privilege (PoLP), avoid using **Get Records** with “Automatically store all fields” unless necessary.
94
-
95
- **Rule ID:** `get-record-all-fields`
96
- **Class Name:** _[GetRecordAllFields](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/GetRecordAllFields.ts)_
97
- **Severity:** 🟡 *Warning*
98
-
99
- ### Hardcoded Id
100
- Avoid hard-coding IDs because they are org specific. Instead, pass them into variables at the start of the flowvia merge-field URL parameters or a **Get Records** element.
101
-
102
- **Rule ID:** `hardcoded-id`
103
- **Class Name:** _[HardcodedId](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/HardcodedId.ts)_
104
- **Severity:** 🔴 *Error*
105
-
106
- ### Hardcoded Url
107
- Avoid hard-coding URLs because they are environment specific. Use an `$API` formula (preferred) or environment-specific sources like custom labels, metadata, or settings.
108
-
109
- **Rule ID:** `hardcoded-url`
110
- **Class Name:** _[HardcodedUrl](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/HardcodedUrl.ts)_
111
- **Severity:** 🔴 *Error*
112
-
113
- ### Inactive Flow
114
- Like cleaning out your closet: deleting unused flows is essential. Inactive flows can still cause trouble—such as accidentally deleting records during testing, or being activated as subflows.
115
-
116
- **Rule ID:** `inactive-flow`
117
- **Class Name:** _[InactiveFlow](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/InactiveFlow.ts)_
118
- **Severity:** 🟡 *Warning*
119
-
120
- ### Invalid API Version
121
- Introducing newer API components may lead to unexpected issues with older versions of Flows, as they might not align with the underlying mechanics. Starting from API version 50.0, the **Api Version** attribute has been readily available on the Flow Object. To ensure smooth operation and reduce discrepancies between API versions, it is strongly advised to regularly update and maintain them.
122
-
123
- **Rule ID:** `invalid-api-version`
124
- **Class Name:** _[APIVersion](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/APIVersion.ts)_
125
- **Severity:** 🟡 *Warning*
126
-
127
- ### Missing Auto Layout
128
- With Canvas Mode set to Auto-Layout, elements are spaced, connected, and aligned automatically, keeping your Flow neatly organized—saving you time.
129
-
130
- **Rule ID:** `missing-auto-layout`
131
- **Class Name:** _[AutoLayout](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/AutoLayout.ts)_
132
- **Severity:** 🔵 *Note*
133
-
134
- ### Missing Fault Path
135
- A flow may fail to execute an operation as intended. By default, the flow displays an error to the user and emails the creator. Customize this behavior by incorporating a Fault Path.
136
-
137
- **Rule ID:** `missing-fault-path`
138
- **Class Name:** _[MissingFaultPath](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingFaultPath.ts)_
139
- **Severity:** 🟡 *Warning*
140
-
141
- ### Missing Filter Record Trigger ![Beta](https://img.shields.io/badge/status-beta-yellow)
142
- Record-triggered flows that lack filters on changed fields or entry conditions can lead to unnecessary executions on every record change. This may degrade system performance, hit governor limits faster, and increase resource consumption in high-volume orgs.
143
-
144
- **Rule ID:** `missing-record-trigger-filter`
145
- **Class Name:** _[MissingFilterRecordTrigger](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingFilterRecordTrigger.ts)_
146
- **Severity:** 🟡 *Warning*
147
-
148
- ### Missing Flow Description
149
- Descriptions play a vital role in documentation. It is highly recommended to include details about where a flow is used and its intended purpose.
150
-
151
- **Rule ID:** `missing-flow-description`
152
- **Class Name:** _[FlowDescription](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/FlowDescription.ts)_
153
- **Severity:** 🔴 *Error*
154
-
155
- ### Missing Metadata Description ![Beta](https://img.shields.io/badge/status-beta-yellow)
156
- Flags Flow elements (Get Records, Assignments, Decisions, Actions, etc.) and metadata components (Variables, Formulas, Constants, Text Templates) that lack a description. Adding concise descriptions greatly improves readability, maintainability, and helps AI tools understand your automation intent.
157
-
158
- **Rule ID:** `missing-metadata-description`
159
- **Class Name:** _[MissingMetadataDescription](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingMetadataDescription.ts)_
160
- **Severity:** 🔴 *Error*
161
-
162
- ### Missing Null Handler
163
- When a **Get Records** operation finds no data, it returns `null`. Validate data by using a Decision element to check for a non-null result.
164
-
165
- **Rule ID:** `missing-null-handler`
166
- **Class Name:** _[MissingNullHandler](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingNullHandler.ts)_
167
- **Severity:** 🟡 *Warning*
168
-
169
- ### Missing Trigger Order
170
- Guarantee your flow execution order with the **Trigger Order** property introduced in Spring '22.value to their flows and guarantee their execution order. This priority value is not an absolute value, so the values need not be sequentially numbered as 1, 2, 3, and so on.
171
-
172
- **Rule ID:** `unspecified-trigger-order`
173
- **Class Name:** _[TriggerOrder](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/TriggerOrder.ts)_
174
- **Severity:** 🔵 *Note*
175
-
176
- ### Process Builder
177
- Salesforce is transitioning away from Workflow Rules and Process Builder in favor of Flow. Begin migrating your organization’s automation to Flow.
178
-
179
- **Rule ID:** `process-builder-usage`
180
- **Class Name:** _[ProcessBuilder](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/ProcessBuilder.ts)_
181
- **Severity:** 🟡 *Warning*
182
-
183
- ### Record ID as String ![Beta](https://img.shields.io/badge/status-beta-yellow)
184
- Detects flows using a String variable named `recordId` as input when they could receive the entire record object instead. Since recent Salesforce releases, record pages and quick actions can pass the complete record, eliminating the need for an additional Get Records query and improving performance.
185
-
186
- **Rule ID:** `record-id-as-string`
187
- **Class Name:** _[RecordIdAsString](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/RecordIdAsString.ts)_
188
- **Severity:** 🔴 *Error*
189
-
190
- ### Recursive After Update
191
- After-update flows are meant for modifying **other** records. Using them on the same record can cause recursion. Consider **before-save** flows for same-record updates.
192
-
193
- **Rule ID:** `recursive-record-update`
194
- **Class Name:** _[RecursiveAfterUpdate](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/RecursiveAfterUpdate.ts)_
195
- **Severity:** 🟡 *Warning*
196
-
197
- ### Same Record Field Updates
198
- Similar to triggers, **before-save** contexts can update the same record via `$Record` without invoking DML.
199
-
200
- **Rule ID:** `same-record-field-updates`
201
- **Class Name:** _[SameRecordFieldUpdates](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/SameRecordFieldUpdates.ts)_
202
- **Severity:** 🟡 *Warning*
203
-
204
- ### SOQL Query In A Loop
205
- To prevent exceeding Apex governor limits, consolidate all SOQL queries at the end of the flow.
206
-
207
- **Rule ID:** `soql-in-loop`
208
- **Class Name:** _[SOQLQueryInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/SOQLQueryInLoop.ts)_
209
- **Severity:** 🔴 *Error*
210
-
211
- ### Transform Instead of Loop ![Beta](https://img.shields.io/badge/status-beta-yellow)
212
- Detects Loop elements that directly connect to Assignment elements. Transform elements handle collection manipulation in bulk operations, providing significant performance improvements over iterative loop-assignment patterns.
213
-
214
- **Rule ID:** `transform-instead-of-loop`
215
- **Class Name:** _[TransformInsteadOfLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/TransformInsteadOfLoop.ts)_
216
- **Severity:** 🔵 *Note*
217
-
218
- ### Unclear API Name
219
- Maintaining multiple elements with a similar name, like `Copy_X_Of_Element`, can diminish the overall readability of your Flow. When copying and pasting these elements, remember to update the API name of the newly created copy.
220
-
221
- **Rule ID:** `unclear-api-naming`
222
- **Class Name:** _[CopyAPIName](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/CopyAPIName.ts)_
223
- **Severity:** 🟡 *Warning*
224
-
225
- ### Unreachable Element
226
- Avoid unconnected elements that are not used by the flow to keep flows efficient and maintainable.
227
-
228
- **Rule ID:** `unreachable-element`
229
- **Class Name:** _[UnconnectedElement](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnconnectedElement.ts)_
230
- **Severity:** 🟡 *Warning*
231
-
232
- ### Unsafe Running Context
233
- This flow is configured to run in System Mode without Sharing. This system context grants all running users the permission to view and edit all data in your org. Running a flow in System Mode without Sharing can lead to unsafe data access.
234
-
235
- **Rule ID:** `unsafe-running-context`
236
- **Class Name:** _[UnsafeRunningContext](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnsafeRunningContext.ts)_
237
- **Severity:** 🔴 *Error*
238
-
239
- ### Unused Variable
240
- To maintain efficiency and manageability, avoid including variables that are never referenced.
241
-
242
- **Rule ID:** `unused-variable`
243
- **Class Name:** _[UnusedVariable](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnusedVariable.ts)_
244
- **Severity:** 🟡 *Warning*
56
+ <!-- START GENERATED_RULES -->
57
+ ### Action Call In A Loop
58
+ Repeatedly invoking Apex actions inside a loop can exhaust governor limits and lead to performance issues. Where possible, bulkify your logic by moving the action call outside the loop and passing a collection variable instead.
59
+
60
+ **Rule ID:** `action-call-in-loop`
61
+ **Class Name:** _[ActionCallsInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/ActionCallsInLoop.ts)_
62
+ **Severity:** 🟡 *Warning*
63
+
64
+ ### DML Statement In A Loop
65
+ Executing DML operations (insert, update, delete) inside a loop is a high-risk anti-pattern that frequently causes governor limit exceptions. All database operations should be collected and executed once, outside the loop.
66
+
67
+ **Rule ID:** `dml-in-loop`
68
+ **Class Name:** _[DMLStatementInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/DMLStatementInLoop.ts)_
69
+ **Severity:** 🔴 *Error*
70
+
71
+ ### Duplicate DML Operation
72
+ When a Flow performs database operations across multiple screens, users navigating backward can cause the same actions to run multiple times. To prevent unintended changes, either restrict backward navigation or redesign the Flow so database operations execute in a single, forward-moving step.
73
+
74
+ **Rule ID:** `duplicate-dml`
75
+ **Class Name:** _[DuplicateDMLOperation](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/DuplicateDMLOperation.ts)_
76
+ **Severity:** 🟡 *Warning*
77
+
78
+ ### Excessive Cyclomatic Complexity
79
+ High numbers of loops and decision elements increase a Flow’s cyclomatic complexity. To maintain simplicity and readability, consider using subflows or splitting a Flow into smaller, ordered Flows.
80
+
81
+ **Rule ID:** `excessive-cyclomatic-complexity`
82
+ **Class Name:** _[CyclomaticComplexity](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/CyclomaticComplexity.ts)_
83
+ **Severity:** 🔵 *Note*
84
+
85
+ ### Flow Naming Convention
86
+ Using clear and consistent Flow names improves readability, discoverability, and maintainability. A good naming convention helps team members quickly understand a Flow’s purpose—for example, including a domain and brief description like Service_OrderFulfillment. Adopt a naming pattern that aligns with your organization’s standards.
87
+
88
+ **Rule ID:** `invalid-naming-convention`
89
+ **Class Name:** _[FlowName](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/FlowName.ts)_
90
+ **Severity:** 🔴 *Error*
91
+
92
+ ### Get Record All Fields
93
+ Avoid using Get Records to retrieve all fields unless necessary. This improves performance, reduces processing time, and limits exposure of unnecessary data.
94
+
95
+ **Rule ID:** `get-record-all-fields`
96
+ **Class Name:** _[GetRecordAllFields](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/GetRecordAllFields.ts)_
97
+ **Severity:** 🟡 *Warning*
98
+
99
+ ### Hardcoded Id
100
+ Avoid hard-coding record IDs, as they are unique to a specific org and will not work in other environments. Instead, store IDs in variablessuch as merge-field URL parameters or a **Get Records** element—to make the Flow portable, maintainable, and flexible.
101
+
102
+ **Rule ID:** `hardcoded-id`
103
+ **Class Name:** _[HardcodedId](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/HardcodedId.ts)_
104
+ **Severity:** 🔴 *Error*
105
+
106
+ ### Hardcoded Url
107
+ Avoid hard-coding URLs, as they may change between environments or over time. Instead, store URLs in variables or custom settings to make the Flow adaptable, maintainable, and environment-independent.
108
+
109
+ **Rule ID:** `hardcoded-url`
110
+ **Class Name:** _[HardcodedUrl](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/HardcodedUrl.ts)_
111
+ **Severity:** 🔴 *Error*
112
+
113
+ ### Inactive Flow
114
+ Inactive Flows should be deleted or archived to reduce risk. Even when inactive, they can cause unintended record changes during testing or be activated as subflows. Keeping only active, relevant Flows improves safety and maintainability.
115
+
116
+ **Rule ID:** `inactive-flow`
117
+ **Class Name:** _[InactiveFlow](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/InactiveFlow.ts)_
118
+ **Severity:** 🟡 *Warning*
119
+
120
+ ### Invalid API Version
121
+ Flows running on outdated API versions may behave inconsistently when newer platform features or components are used. From API version 50.0 onward, the API Version attribute explicitly controls Flow runtime behavior. Keeping Flows aligned with a supported API version helps prevent compatibility issues and ensures predictable execution.
122
+
123
+ **Rule ID:** `invalid-api-version`
124
+ **Class Name:** _[APIVersion](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/APIVersion.ts)_
125
+ **Severity:** 🟡 *Warning*
126
+
127
+ ### Missing Auto Layout
128
+ Auto-Layout automatically arranges and aligns Flow elements, keeping the canvas organized and easier to maintain. Enabling it saves time and improves readability.
129
+
130
+ **Rule ID:** `missing-auto-layout`
131
+ **Class Name:** _[AutoLayout](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/AutoLayout.ts)_
132
+ **Severity:** 🔵 *Note*
133
+
134
+ ### Missing Fault Path
135
+ Elements that can fail should include a Fault Path to handle errors gracefully. Without it, failures show generic errors to users. Fault Paths improve reliability and user experience.
136
+
137
+ **Rule ID:** `missing-fault-path`
138
+ **Class Name:** _[MissingFaultPath](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingFaultPath.ts)_
139
+ **Severity:** 🟡 *Warning*
140
+
141
+ ### Missing Filter Record Trigger ![Beta](https://img.shields.io/badge/status-beta-yellow)
142
+ Record-triggered Flows without filters on changed fields or entry conditions execute on every record change. Adding filters ensures the Flow runs only when needed, improving performance.
143
+
144
+ **Rule ID:** `missing-record-trigger-filter`
145
+ **Class Name:** _[MissingFilterRecordTrigger](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingFilterRecordTrigger.ts)_
146
+ **Severity:** 🟡 *Warning*
147
+
148
+ ### Missing Flow Description
149
+ Flow descriptions are essential for documentation and maintainability. Include a description for each Flow, explaining its purpose and where it’s used.
150
+
151
+ **Rule ID:** `missing-flow-description`
152
+ **Class Name:** _[FlowDescription](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/FlowDescription.ts)_
153
+ **Severity:** 🔴 *Error*
154
+
155
+ ### Missing Metadata Description ![Beta](https://img.shields.io/badge/status-beta-yellow)
156
+ Elements and metadata without a description reduce clarity and maintainability. Adding descriptions improves readability and makes your automation easier to understand.
157
+
158
+ **Rule ID:** `missing-metadata-description`
159
+ **Class Name:** _[MissingMetadataDescription](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingMetadataDescription.ts)_
160
+ **Severity:** 🟡 *Warning*
161
+
162
+ ### Missing Null Handler
163
+ Get Records operations return null when no data is found. Without handling these null values, Flows can fail or produce unintended results. Adding a null check improves reliability and ensures the Flow behaves as expected.
164
+
165
+ **Rule ID:** `missing-null-handler`
166
+ **Class Name:** _[MissingNullHandler](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/MissingNullHandler.ts)_
167
+ **Severity:** 🟡 *Warning*
168
+
169
+ ### Missing Trigger Order
170
+ Record-triggered Flows without a specified Trigger Order may execute in an unpredictable sequence. Setting a Trigger Order ensures your Flows run in the intended order.
171
+
172
+ **Rule ID:** `unspecified-trigger-order`
173
+ **Class Name:** _[TriggerOrder](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/TriggerOrder.ts)_
174
+ **Severity:** 🔵 *Note*
175
+
176
+ ### Process Builder
177
+ Process Builder is retired. Continuing to use it increases maintenance overhead and risks future compatibility issues. Migrating automation to Flow reduces risk and improves maintainability.
178
+
179
+ **Rule ID:** `process-builder-usage`
180
+ **Class Name:** _[ProcessBuilder](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/ProcessBuilder.ts)_
181
+ **Severity:** 🔴 *Error*
182
+
183
+ ### Record ID as String ![Beta](https://img.shields.io/badge/status-beta-yellow)
184
+ Flows that use a String variable for a record ID instead of receiving the full record introduce unnecessary complexity and additional Get Records queries. Using the complete record simplifies the Flow and improves performance.
185
+
186
+ **Rule ID:** `record-id-as-string`
187
+ **Class Name:** _[RecordIdAsString](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/RecordIdAsString.ts)_
188
+ **Severity:** 🔵 *Note*
189
+
190
+ ### Recursive After Update
191
+ After-save Flows that update the same record can trigger recursion, causing unintended behavior or performance issues. Avoid updating the triggering record in after-save Flows; use before-save Flows instead to prevent recursion.
192
+
193
+ **Rule ID:** `recursive-record-update`
194
+ **Class Name:** _[RecursiveAfterUpdate](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/RecursiveAfterUpdate.ts)_
195
+ **Severity:** 🟡 *Warning*
196
+
197
+ ### Same Record Field Updates
198
+ Before-save Flows can safely update the triggering record directly via $Record, applying changes efficiently without extra DML operations. Using before-save updates improves performance
199
+
200
+ **Rule ID:** `same-record-field-updates`
201
+ **Class Name:** _[SameRecordFieldUpdates](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/SameRecordFieldUpdates.ts)_
202
+ **Severity:** 🟡 *Warning*
203
+
204
+ ### SOQL Query In A Loop
205
+ Running SOQL queries inside a loop can rapidly exceed query limits and severely degrade performance. Queries should be executed once, with results reused throughout the loop.
206
+
207
+ **Rule ID:** `soql-in-loop`
208
+ **Class Name:** _[SOQLQueryInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/SOQLQueryInLoop.ts)_
209
+ **Severity:** 🔴 *Error*
210
+
211
+ ### Transform Instead of Loop ![Beta](https://img.shields.io/badge/status-beta-yellow)
212
+ Loop elements that perform direct Assignments on each item can slow down Flows. Using Transform elements allows bulk operations on collections, improving performance and reducing complexity.
213
+
214
+ **Rule ID:** `transform-instead-of-loop`
215
+ **Class Name:** _[TransformInsteadOfLoop](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/TransformInsteadOfLoop.ts)_
216
+ **Severity:** 🔵 *Note*
217
+
218
+ ### Unclear API Name
219
+ Elements with unclear or duplicated API names, like Copy_X_Of_Element, reduce Flow readability. Make sure to update the API name when copying elements to keep your Flow organized.
220
+
221
+ **Rule ID:** `unclear-api-naming`
222
+ **Class Name:** _[CopyAPIName](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/CopyAPIName.ts)_
223
+ **Severity:** 🟡 *Warning*
224
+
225
+ ### Unreachable Element
226
+ Unconnected elements never execute and add unnecessary clutter. Remove or connect unused Flow elements to keep Flows clean and efficient.
227
+
228
+ **Rule ID:** `unreachable-element`
229
+ **Class Name:** _[UnconnectedElement](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnconnectedElement.ts)_
230
+ **Severity:** 🟡 *Warning*
231
+
232
+ ### Unsafe Running Context
233
+ Flows configured to run in System Mode without Sharing grant access to all data, bypassing user permissions. Avoid this setting to prevent security risks and protect sensitive data.
234
+
235
+ **Rule ID:** `unsafe-running-context`
236
+ **Class Name:** _[UnsafeRunningContext](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnsafeRunningContext.ts)_
237
+ **Severity:** 🔴 *Error*
238
+
239
+ ### Unused Variable
240
+ Unused variables are never referenced and add unnecessary clutter. Remove them to keep Flows efficient and easy to maintain.
241
+
242
+ **Rule ID:** `unused-variable`
243
+ **Class Name:** _[UnusedVariable](https://github.com/Flow-Scanner/lightning-flow-scanner/blob/main/packages/core/src/main/rules/UnusedVariable.ts)_
244
+ **Severity:** 🟡 *Warning*
245
245
  <!-- END GENERATED_RULES -->
246
246
 
247
247
  ---
@@ -253,21 +253,22 @@ It is recommend to configure and define:
253
253
  - The severity of violating any specific rule.
254
254
  - Expressions used for rules, such as REGEX patterns and comparison operators.
255
255
  - Any known exceptions that should be ignored during scanning.
256
- - Flows or directories to exclude from scanning entirely.
257
256
 
258
257
  ```json
259
258
  {
260
259
  "rules": {
261
- // Your rules here
260
+ // Your rule configurations
262
261
  },
263
262
  "exceptions": {
264
- // Your exceptions here
263
+ // Your defined exceptions
265
264
  }
266
265
  }
267
266
  ```
268
267
 
269
268
  Most Lightning Flow Scanner distributions automatically resolve configurations from `.flow-scanner.yml`, `.flow-scanner.json`, or `package.json` → `flowScanner`.
270
269
 
270
+ ### Configure Rules
271
+
271
272
  By default, all default rules are executed. You can customize individual rules and override the rules to be executed without having to specify every rule. Below is a breakdown of the available attributes of rule configuration:
272
273
 
273
274
  ```json
@@ -276,24 +277,23 @@ By default, all default rules are executed. You can customize individual rules a
276
277
  "<RuleId>": {
277
278
  "severity": "<Severity>", // Override severity level
278
279
  "expression": "<Expression>", // Override rule expression
279
- "enabled": "false" // Disable this rule
280
+ "message": "<Message>", // Set custom message
281
+ "enabled": false // Disable this rule
280
282
  }
281
283
  }
282
284
  }
283
285
  ```
284
286
 
285
- ### Configure Severity Levels
286
-
287
- When the severity is not provided it will be `warning` by default. Other available values for severity are `error` and `note`. Configure the severity per rule as shown below:
287
+ When the severity is not provided it will be `warning` by default. Other available values for severity are `error` and `note`. Configure the severity per rule as demonstrated below:
288
288
 
289
289
  ```json
290
290
  {
291
291
  "rules": {
292
- "missing-flow-description": {
293
- "severity": "error"
292
+ "record-id-as-string": {
293
+ "severity": "warning",
294
294
  },
295
- "unused-variable": {
296
- "severity": "note"
295
+ "unclear-api-naming": {
296
+ "severity": "error",
297
297
  }
298
298
  }
299
299
  }
@@ -301,13 +301,13 @@ When the severity is not provided it will be `warning` by default. Other availab
301
301
 
302
302
  ### Overwrite Expressions
303
303
 
304
- Some rules have an expression to configure, such as the expression, that will overwrite default values. These can be configured in the same way as severity as shown in the following example.
304
+ Some rules are configurable and allow overriding their default expressions. You configure these overrides the same way as severity, as shown in the examples below.
305
305
 
306
306
  ```json
307
307
  {
308
308
  "rules": {
309
309
  "invalid-api-version": {
310
- "expression": "===58" // comparison operator
310
+ "expression": "===58" // comparison expression
311
311
  },
312
312
  "invalid-naming-convention": {
313
313
  "expression": "[A-Za-z0-9]" // regular expression
@@ -348,13 +348,11 @@ _Example_
348
348
  }
349
349
  ```
350
350
 
351
- ### Exclude Flows from Scanning
352
-
353
- Lightning Flow Scanner provides two complementary ways to exclude flows from scanning:
351
+ ### Exclude Flows
354
352
 
355
353
  #### Exclude by File Path (Node.js only)
356
354
 
357
- Use glob patterns to exclude flows based on their file system location. This is useful for excluding entire directories or specific file patterns during the flow discovery phase:
355
+ Use glob patterns to exclude flows based on their file system location. This is useful for excluding entire directories or specific name patterns:
358
356
 
359
357
  ```json
360
358
  {
@@ -365,8 +363,6 @@ Use glob patterns to exclude flows based on their file system location. This is
365
363
  }
366
364
  ```
367
365
 
368
- **Note**: The `ignore` option uses glob patterns and applies during file discovery before flows are parsed. This is the most efficient way to exclude large numbers of flows.
369
-
370
366
  **Environment compatibility**: `ignore` requires Node.js (file system access) and is available in CLI Plugin, VS Code Extension, and GitHub Action. It is **not** available when using the Core Library in browser/web environments.
371
367
 
372
368
  #### Exclude by Flow API Name (Browser-compatible)
@@ -386,8 +382,6 @@ Exclude specific flows by their unique API names, regardless of their location.
386
382
  }
387
383
  ```
388
384
 
389
- **Note**: The `ignoreFlows` option applies after flows are parsed, using the flow's API name (the `<fullName>` element in the flow metadata). Flow names are unique identifiers and work regardless of the flow's file system location.
390
-
391
385
  **Environment compatibility**: `ignoreFlows` works in **all environments** including Node.js and browser/web distributions, as it operates on parsed flow data rather than file system paths.
392
386
 
393
387
  ### Scan Modes
@@ -107,7 +107,8 @@ function exportDetails(results, includeDetails = false) {
107
107
  flowFile,
108
108
  flowName,
109
109
  ruleName: rule.ruleName,
110
- severity: (_rule_severity = rule.severity) !== null && _rule_severity !== void 0 ? _rule_severity : "warning"
110
+ severity: (_rule_severity = rule.severity) !== null && _rule_severity !== void 0 ? _rule_severity : "warning",
111
+ message: rule.message || rule.ruleDefinition.description
111
112
  });
112
113
  // Flatten details object into top-level properties if includeDetails is true
113
114
  if (includeDetails && details) {
@@ -63,7 +63,7 @@ function exportSarif(results) {
63
63
  }
64
64
  ],
65
65
  message: {
66
- text: r.errorMessage || `${r.ruleName} in ${d.name}`
66
+ text: r.errorMessage || (r.message || r.ruleDefinition.description ? `${r.message || r.ruleDefinition.description} (${d.name})` : `${r.ruleName} in ${d.name}`)
67
67
  },
68
68
  properties: _object_spread({
69
69
  element: d.name,
@@ -81,11 +81,11 @@ function exportSarif(results) {
81
81
  level: mapSeverity(r.severity)
82
82
  },
83
83
  fullDescription: {
84
- text: r.ruleDefinition.description || ""
84
+ text: r.message || r.ruleDefinition.description || ""
85
85
  },
86
86
  id: r.ruleName,
87
87
  shortDescription: {
88
- text: r.ruleDefinition.description || r.ruleName
88
+ text: r.message || r.ruleDefinition.description || r.ruleName
89
89
  }
90
90
  })),
91
91
  version: "1.0.0"
@@ -76,6 +76,10 @@ function ScanFlows(flows, ruleOptions) {
76
76
  const config = getRuleConfigByIdOrName(rule, ruleOptions === null || ruleOptions === void 0 ? void 0 : ruleOptions.rules);
77
77
  const suppressions = getSuppressionsForRule(rule, flow.name, ruleOptions === null || ruleOptions === void 0 ? void 0 : ruleOptions.exceptions);
78
78
  const result = config && Object.keys(config).length > 0 ? rule.execute(flow, config, suppressions) : rule.execute(flow, undefined, suppressions);
79
+ // Apply custom message if provided in config
80
+ if (config && typeof config === 'object' && 'message' in config && typeof config.message === 'string') {
81
+ result.message = config.message;
82
+ }
79
83
  if (result.details.length > 0) {
80
84
  let flowXml = flowXmlCache.get(flow.name);
81
85
  if (!flowXml) {
@@ -4,6 +4,7 @@ export interface FlatViolation extends Omit<Violation, 'details'> {
4
4
  flowName: string;
5
5
  ruleName: string;
6
6
  severity: string;
7
+ message?: string;
7
8
  dataType?: string;
8
9
  locationX?: string;
9
10
  locationY?: string;
@@ -7,5 +7,6 @@ export declare class RuleResult {
7
7
  severity: string;
8
8
  details: Violation[];
9
9
  errorMessage: string;
10
+ message?: string;
10
11
  constructor(info: IRuleDefinition, details: Violation[], errorMessage?: string);
11
12
  }
@@ -29,6 +29,7 @@ let RuleResult = class RuleResult {
29
29
  _define_property(this, "severity", void 0);
30
30
  _define_property(this, "details", []);
31
31
  _define_property(this, "errorMessage", void 0);
32
+ _define_property(this, "message", void 0); // Custom message that overrides the default rule description
32
33
  this.ruleDefinition = info;
33
34
  this.ruleName = info.name;
34
35
  this.severity = info.severity ? info.severity : "warning";
@@ -116,7 +116,7 @@ let APIVersion = class APIVersion extends _RuleCommon.RuleCommon {
116
116
  ruleId: "invalid-api-version",
117
117
  name: "APIVersion",
118
118
  label: "Invalid API Version",
119
- description: "Introducing newer API components may lead to unexpected issues with older versions of Flows, as they might not align with the underlying mechanics. Starting from API version 50.0, the **Api Version** attribute has been readily available on the Flow Object. To ensure smooth operation and reduce discrepancies between API versions, it is strongly advised to regularly update and maintain them.",
119
+ description: "Flows running on outdated API versions may behave inconsistently when newer platform features or components are used. From API version 50.0 onward, the API Version attribute explicitly controls Flow runtime behavior. Keeping Flows aligned with a supported API version helps prevent compatibility issues and ensures predictable execution.",
120
120
  supportedTypes: _internals.FlowType.allTypes(),
121
121
  docRefs: []
122
122
  });
@@ -20,7 +20,7 @@ let ActionCallsInLoop = class ActionCallsInLoop extends _LoopRuleCommon.LoopRule
20
20
  constructor(){
21
21
  super({
22
22
  ruleId: "action-call-in-loop",
23
- description: "To prevent exceeding Apex governor limits, it is advisable to consolidate and bulkify your apex calls, utilizing a single action call containing a collection variable at the end of the loop.",
23
+ description: "Repeatedly invoking Apex actions inside a loop can exhaust governor limits and lead to performance issues. Where possible, bulkify your logic by moving the action call outside the loop and passing a collection variable instead.",
24
24
  docRefs: [
25
25
  {
26
26
  label: "Action Call In A Loop",
@@ -31,7 +31,7 @@ let ActionCallsInLoop = class ActionCallsInLoop extends _LoopRuleCommon.LoopRule
31
31
  name: "ActionCallsInLoop",
32
32
  supportedTypes: _internals.FlowType.backEndTypes
33
33
  }, {
34
- severity: "error"
34
+ severity: "warning"
35
35
  });
36
36
  }
37
37
  };
@@ -68,7 +68,7 @@ let AutoLayout = class AutoLayout extends _RuleCommon.RuleCommon {
68
68
  ruleId: "missing-auto-layout",
69
69
  name: "AutoLayout",
70
70
  label: "Missing Auto Layout",
71
- description: "With Canvas Mode set to Auto-Layout, elements are spaced, connected, and aligned automatically, keeping your Flow neatly organized—saving you time.",
71
+ description: "Auto-Layout automatically arranges and aligns Flow elements, keeping the canvas organized and easier to maintain. Enabling it saves time and improves readability.",
72
72
  supportedTypes: _internals.FlowType.allTypes(),
73
73
  docRefs: []
74
74
  }, {
@@ -62,7 +62,7 @@ let CopyAPIName = class CopyAPIName extends _RuleCommon.RuleCommon {
62
62
  ruleId: "unclear-api-naming",
63
63
  name: "CopyAPIName",
64
64
  label: "Unclear API Name",
65
- description: "Maintaining multiple elements with a similar name, like `Copy_X_Of_Element`, can diminish the overall readability of your Flow. When copying and pasting these elements, remember to update the API name of the newly created copy.",
65
+ description: "Elements with unclear or duplicated API names, like Copy_X_Of_Element, reduce Flow readability. Make sure to update the API name when copying elements to keep your Flow organized.",
66
66
  supportedTypes: _internals.FlowType.allTypes(),
67
67
  docRefs: []
68
68
  });
@@ -90,7 +90,7 @@ let CyclomaticComplexity = class CyclomaticComplexity extends _RuleCommon.RuleCo
90
90
  ruleId: "excessive-cyclomatic-complexity",
91
91
  name: "CyclomaticComplexity",
92
92
  label: "Excessive Cyclomatic Complexity",
93
- description: `The number of loops and decision rules, plus the number of decisions. Use a combination of 1) subflows and 2) breaking flows into multiple concise trigger ordered flows, to reduce the cyclomatic complexity within a single flow, ensuring maintainability and simplicity.`,
93
+ description: "High numbers of loops and decision elements increase a Flow’s cyclomatic complexity. To maintain simplicity and readability, consider using subflows or splitting a Flow into smaller, ordered Flows.",
94
94
  supportedTypes: _internals.FlowType.backEndTypes,
95
95
  docRefs: [
96
96
  {
@@ -21,7 +21,7 @@ let DMLStatementInLoop = class DMLStatementInLoop extends _LoopRuleCommon.LoopRu
21
21
  constructor(){
22
22
  super({
23
23
  ruleId: "dml-in-loop",
24
- description: "To prevent exceeding Apex governor limits, consolidate all your database operations—record creation, updates, or deletions—at the conclusion of the flow.",
24
+ description: "Executing DML operations (insert, update, delete) inside a loop is a high-risk anti-pattern that frequently causes governor limit exceptions. All database operations should be collected and executed once, outside the loop.",
25
25
  docRefs: [
26
26
  {
27
27
  label: "Flow Best Practices",
@@ -97,7 +97,7 @@ let DuplicateDMLOperation = class DuplicateDMLOperation extends _RuleCommon.Rule
97
97
  ruleId: "duplicate-dml",
98
98
  name: "DuplicateDMLOperation",
99
99
  label: "Duplicate DML Operation",
100
- description: "When a flow executes database changes or actions between two screens, prevent users from navigating backward between screens; otherwise, duplicate database operations may be performed.",
100
+ description: "When a Flow performs database operations across multiple screens, users navigating backward can cause the same actions to run multiple times. To prevent unintended changes, either restrict backward navigation or redesign the Flow so database operations execute in a single, forward-moving step.",
101
101
  supportedTypes: _internals.FlowType.visualTypes,
102
102
  docRefs: []
103
103
  });
@@ -64,7 +64,7 @@ let FlowDescription = class FlowDescription extends _RuleCommon.RuleCommon {
64
64
  constructor(){
65
65
  super({
66
66
  ruleId: "missing-flow-description",
67
- description: "Descriptions play a vital role in documentation. It is highly recommended to include details about where a flow is used and its intended purpose.",
67
+ description: "Flow descriptions are essential for documentation and maintainability. Include a description for each Flow, explaining its purpose and where it’s used.",
68
68
  docRefs: [],
69
69
  label: "Missing Flow Description",
70
70
  name: "FlowDescription",
@@ -67,7 +67,7 @@ let FlowName = class FlowName extends _RuleCommon.RuleCommon {
67
67
  constructor(){
68
68
  super({
69
69
  ruleId: "invalid-naming-convention",
70
- description: "The readability of a flow is paramount. Establishing a naming convention significantly enhances findability, searchability, and overall consistency. Include at least a domain and a brief description of the flow’s actions, for example `Service_OrderFulfillment`.",
70
+ description: "Using clear and consistent Flow names improves readability, discoverability, and maintainability. A good naming convention helps team members quickly understand a Flow’s purpose—for example, including a domain and brief description like Service_OrderFulfillment. Adopt a naming pattern that aligns with your organization’s standards.",
71
71
  docRefs: [
72
72
  {
73
73
  label: "Naming your Flows is more critical than ever. By Stephen Church",
@@ -69,7 +69,7 @@ let GetRecordAllFields = class GetRecordAllFields extends _RuleCommon.RuleCommon
69
69
  constructor(){
70
70
  super({
71
71
  ruleId: "get-record-all-fields",
72
- description: "Following the principle of least privilege (PoLP), avoid using **Get Records** with “Automatically store all fields” unless necessary.",
72
+ description: "Avoid using Get Records to retrieve all fields unless necessary. This improves performance, reduces processing time, and limits exposure of unnecessary data.",
73
73
  docRefs: [
74
74
  {
75
75
  label: "Get Records Stores All Fields",
@@ -61,7 +61,7 @@ let HardcodedId = class HardcodedId extends _RuleCommon.RuleCommon {
61
61
  ruleId: "hardcoded-id",
62
62
  name: "HardcodedId",
63
63
  label: "Hardcoded Id",
64
- description: "Avoid hard-coding IDs because they are org specific. Instead, pass them into variables at the start of the flowvia merge-field URL parameters or a **Get Records** element.",
64
+ description: "Avoid hard-coding record IDs, as they are unique to a specific org and will not work in other environments. Instead, store IDs in variablessuch as merge-field URL parameters or a **Get Records** element—to make the Flow portable, maintainable, and flexible.",
65
65
  supportedTypes: _internals.FlowType.allTypes(),
66
66
  docRefs: [
67
67
  {
@@ -19,7 +19,7 @@ let HardcodedUrl = class HardcodedUrl extends _RuleCommon.RuleCommon {
19
19
  constructor(){
20
20
  super({
21
21
  ruleId: "hardcoded-url",
22
- description: "Avoid hard-coding URLs because they are environment specific. Use an `$API` formula (preferred) or environment-specific sources like custom labels, metadata, or settings.",
22
+ description: "Avoid hard-coding URLs, as they may change between environments or over time. Instead, store URLs in variables or custom settings to make the Flow adaptable, maintainable, and environment-independent.",
23
23
  docRefs: [
24
24
  {
25
25
  label: "The Ultimate Guide to Salesforce Flow Best Practices",
@@ -65,7 +65,7 @@ let InactiveFlow = class InactiveFlow extends _RuleCommon.RuleCommon {
65
65
  ruleId: "inactive-flow",
66
66
  name: "InactiveFlow",
67
67
  label: "Inactive Flow",
68
- description: "Like cleaning out your closet: deleting unused flows is essential. Inactive flows can still cause trouble—such as accidentally deleting records during testing, or being activated as subflows.",
68
+ description: "Inactive Flows should be deleted or archived to reduce risk. Even when inactive, they can cause unintended record changes during testing or be activated as subflows. Keeping only active, relevant Flows improves safety and maintainability.",
69
69
  supportedTypes: _internals.FlowType.allTypes(),
70
70
  docRefs: []
71
71
  });
@@ -127,7 +127,7 @@ let MissingFaultPath = class MissingFaultPath extends _RuleCommon.RuleCommon {
127
127
  constructor(){
128
128
  super({
129
129
  ruleId: "missing-fault-path",
130
- description: "A flow may fail to execute an operation as intended. By default, the flow displays an error to the user and emails the creator. Customize this behavior by incorporating a Fault Path.",
130
+ description: "Elements that can fail should include a Fault Path to handle errors gracefully. Without it, failures show generic errors to users. Fault Paths improve reliability and user experience.",
131
131
  docRefs: [
132
132
  {
133
133
  label: "Flow Best Practices",
@@ -66,13 +66,13 @@ let MissingMetadataDescription = class MissingMetadataDescription extends _RuleC
66
66
  constructor(){
67
67
  super({
68
68
  ruleId: "missing-metadata-description",
69
- description: "Flags Flow elements (Get Records, Assignments, Decisions, Actions, etc.) and metadata components (Variables, Formulas, Constants, Text Templates) that lack a description. Adding concise descriptions greatly improves readability, maintainability, and helps AI tools understand your automation intent.",
69
+ description: "Elements and metadata without a description reduce clarity and maintainability. Adding descriptions improves readability and makes your automation easier to understand.",
70
70
  docRefs: [],
71
71
  label: "Missing Metadata Description",
72
72
  name: "MissingMetadataDescription",
73
73
  supportedTypes: _internals.FlowType.allTypes()
74
74
  }, {
75
- severity: "error"
75
+ severity: "warning"
76
76
  });
77
77
  }
78
78
  };
@@ -138,7 +138,7 @@ let MissingNullHandler = class MissingNullHandler extends _RuleCommon.RuleCommon
138
138
  constructor(){
139
139
  super({
140
140
  ruleId: "missing-null-handler",
141
- description: "When a **Get Records** operation finds no data, it returns `null`. Validate data by using a Decision element to check for a non-null result.",
141
+ description: "Get Records operations return null when no data is found. Without handling these null values, Flows can fail or produce unintended results. Adding a null check improves reliability and ensures the Flow behaves as expected.",
142
142
  docRefs: [],
143
143
  label: "Missing Null Handler",
144
144
  name: "MissingNullHandler",
@@ -80,7 +80,7 @@ let MissingRecordTriggerFilter = class MissingRecordTriggerFilter extends _RuleC
80
80
  ruleId: "missing-record-trigger-filter",
81
81
  name: "MissingRecordTriggerFilter",
82
82
  label: "Missing Filter Record Trigger",
83
- description: "Record-triggered flows that lack filters on changed fields or entry conditions can lead to unnecessary executions on every record change. This may degrade system performance, hit governor limits faster, and increase resource consumption in high-volume orgs.",
83
+ description: "Record-triggered Flows without filters on changed fields or entry conditions execute on every record change. Adding filters ensures the Flow runs only when needed, improving performance.",
84
84
  supportedTypes: [
85
85
  _internals.FlowType.autolaunchedType
86
86
  ],
@@ -62,7 +62,7 @@ let ProcessBuilder = class ProcessBuilder extends _RuleCommon.RuleCommon {
62
62
  ruleId: "process-builder-usage",
63
63
  name: "ProcessBuilder",
64
64
  label: "Process Builder",
65
- description: "Salesforce is transitioning away from Workflow Rules and Process Builder in favor of Flow. Begin migrating your organization’s automation to Flow.",
65
+ description: "Process Builder is retired. Continuing to use it increases maintenance overhead and risks future compatibility issues. Migrating automation to Flow reduces risk and improves maintainability.",
66
66
  supportedTypes: _internals.FlowType.processBuilder,
67
67
  docRefs: [
68
68
  {
@@ -70,6 +70,8 @@ let ProcessBuilder = class ProcessBuilder extends _RuleCommon.RuleCommon {
70
70
  path: "https://help.salesforce.com/s/articleView?id=000389396&type=1"
71
71
  }
72
72
  ]
73
+ }, {
74
+ severity: "error"
73
75
  });
74
76
  }
75
77
  };
@@ -76,7 +76,7 @@ let RecordIdAsString = class RecordIdAsString extends _RuleCommon.RuleCommon {
76
76
  ruleId: "record-id-as-string",
77
77
  name: "RecordIdAsString",
78
78
  label: "Record ID as String",
79
- description: "Detects flows using a String variable named `recordId` as input when they could receive the entire record object instead. Since recent Salesforce releases, record pages and quick actions can pass the complete record, eliminating the need for an additional Get Records query and improving performance.",
79
+ description: "Flows that use a String variable for a record ID instead of receiving the full record introduce unnecessary complexity and additional Get Records queries. Using the complete record simplifies the Flow and improves performance.",
80
80
  supportedTypes: [
81
81
  ..._internals.FlowType.visualTypes,
82
82
  _internals.FlowType.autolaunchedType
@@ -88,7 +88,7 @@ let RecordIdAsString = class RecordIdAsString extends _RuleCommon.RuleCommon {
88
88
  }
89
89
  ]
90
90
  }, {
91
- severity: "error"
91
+ severity: "note"
92
92
  });
93
93
  }
94
94
  };
@@ -105,7 +105,7 @@ let RecursiveAfterUpdate = class RecursiveAfterUpdate extends _RuleCommon.RuleCo
105
105
  constructor(){
106
106
  super({
107
107
  ruleId: "recursive-record-update",
108
- description: "After-update flows are meant for modifying **other** records. Using them on the same record can cause recursion. Consider **before-save** flows for same-record updates.",
108
+ description: "After-save Flows that update the same record can trigger recursion, causing unintended behavior or performance issues. Avoid updating the triggering record in after-save Flows; use before-save Flows instead to prevent recursion.",
109
109
  docRefs: [
110
110
  {
111
111
  label: "Learn about same record field updates",
@@ -19,7 +19,7 @@ let SOQLQueryInLoop = class SOQLQueryInLoop extends _LoopRuleCommon.LoopRuleComm
19
19
  constructor(){
20
20
  super({
21
21
  ruleId: "soql-in-loop",
22
- description: "To prevent exceeding Apex governor limits, consolidate all SOQL queries at the end of the flow.",
22
+ description: "Running SOQL queries inside a loop can rapidly exceed query limits and severely degrade performance. Queries should be executed once, with results reused throughout the loop.",
23
23
  docRefs: [
24
24
  {
25
25
  label: "Flow Best Practices",
@@ -89,7 +89,7 @@ let SameRecordFieldUpdates = class SameRecordFieldUpdates extends _RuleCommon.Ru
89
89
  ruleId: "same-record-field-updates",
90
90
  name: "SameRecordFieldUpdates",
91
91
  label: "Same Record Field Updates",
92
- description: "Similar to triggers, **before-save** contexts can update the same record via `$Record` without invoking DML.",
92
+ description: "Before-save Flows can safely update the triggering record directly via $Record, applying changes efficiently without extra DML operations. Using before-save updates improves performance",
93
93
  supportedTypes: [
94
94
  ..._internals.FlowType.backEndTypes
95
95
  ],
@@ -79,7 +79,7 @@ let TransformInsteadOfLoop = class TransformInsteadOfLoop extends _RuleCommon.Ru
79
79
  ruleId: "transform-instead-of-loop",
80
80
  name: "TransformInsteadOfLoop",
81
81
  label: "Transform Instead of Loop",
82
- description: "Detects Loop elements that directly connect to Assignment elements. Transform elements handle collection manipulation in bulk operations, providing significant performance improvements over iterative loop-assignment patterns.",
82
+ description: "Loop elements that perform direct Assignments on each item can slow down Flows. Using Transform elements allows bulk operations on collections, improving performance and reducing complexity.",
83
83
  supportedTypes: _internals.FlowType.allTypes(),
84
84
  docRefs: [
85
85
  {
@@ -71,7 +71,7 @@ let TriggerOrder = class TriggerOrder extends _RuleCommon.RuleCommon {
71
71
  ruleId: "unspecified-trigger-order",
72
72
  name: "TriggerOrder",
73
73
  label: "Missing Trigger Order",
74
- description: "Guarantee your flow execution order with the **Trigger Order** property introduced in Spring '22." + "value to their flows and guarantee their execution order. This priority value is not an " + "absolute value, so the values need not be sequentially numbered as 1, 2, 3, and so on.",
74
+ description: "Record-triggered Flows without a specified Trigger Order may execute in an unpredictable sequence. Setting a Trigger Order ensures your Flows run in the intended order.",
75
75
  supportedTypes: [
76
76
  _internals.FlowType.autolaunchedType
77
77
  ],
@@ -62,7 +62,7 @@ let UnconnectedElement = class UnconnectedElement extends _RuleCommon.RuleCommon
62
62
  constructor(){
63
63
  super({
64
64
  ruleId: "unreachable-element",
65
- description: "Avoid unconnected elements that are not used by the flow to keep flows efficient and maintainable.",
65
+ description: "Unconnected elements never execute and add unnecessary clutter. Remove or connect unused Flow elements to keep Flows clean and efficient.",
66
66
  docRefs: [],
67
67
  label: "Unreachable Element",
68
68
  name: "UnconnectedElement",
@@ -70,7 +70,7 @@ let UnsafeRunningContext = class UnsafeRunningContext extends _RuleCommon.RuleCo
70
70
  ruleId: "unsafe-running-context",
71
71
  name: "UnsafeRunningContext",
72
72
  label: "Unsafe Running Context",
73
- description: `This flow is configured to run in System Mode without Sharing. This system context grants all running users the permission to view and edit all data in your org. Running a flow in System Mode without Sharing can lead to unsafe data access.`,
73
+ description: "Flows configured to run in System Mode without Sharing grant access to all data, bypassing user permissions. Avoid this setting to prevent security risks and protect sensitive data.",
74
74
  supportedTypes: [
75
75
  ..._internals.FlowType.backEndTypes,
76
76
  ..._internals.FlowType.visualTypes
@@ -82,7 +82,7 @@ let UnusedVariable = class UnusedVariable extends _RuleCommon.RuleCommon {
82
82
  ruleId: "unused-variable",
83
83
  name: "UnusedVariable",
84
84
  label: "Unused Variable",
85
- description: "To maintain efficiency and manageability, avoid including variables that are never referenced.",
85
+ description: "Unused variables are never referenced and add unnecessary clutter. Remove them to keep Flows efficient and easy to maintain.",
86
86
  supportedTypes: [
87
87
  ..._internals.FlowType.backEndTypes,
88
88
  ..._internals.FlowType.visualTypes
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@flow-scanner/lightning-flow-scanner-core",
3
3
  "description": "A lightweight engine for Flow metadata in Node.js, and browser environments. Assess and enhance Salesforce Flow automations for best practices, security, governor limits, and performance issues.",
4
- "version": "6.14.0",
4
+ "version": "6.15.0",
5
5
  "main": "index.js",
6
6
  "exports": {
7
7
  ".": {