Rule documentation
Learn everything about our rules, and how to leverage them drive absolute quality in your development team.
Common Weakness Enumeration mapping
What types of rules are supported by Clayton?
Avoid Inline CSS Styles
Use native ZIP functions over Zippex
Hardcoded secret
Passwords set programmatically
Avoid Using HTTP Referer Headers
Flow Access Restriction
Email spamming risk
Insecure sharing to external users
Server-side Payload Injection
User Registration Without Limits
LWC Clickjacking on CSS
Import of sensitive fields in Lightning Web Components (LWC)
Direct DOM manipulation in Lightning Web Components (LWC)
Sensitive information storage
Sensitive information logging
Excessive data access permissions
Subresource integrity
Content Security Policy (CSP)
Insecure endpoints
Named credentials
Randomization of cryptographic keys
Use of Session storage and Local storage
Use of Session ID in Visualforce
Multiple automation on the same object
Multiple record-triggered flows on the same object
Call to blocklisted method
Missing fault path in Flows
Identify methods with global visibility
Asynchronous methods in loops
Boundaries on SOQL statements
Bulkification of triggers
Business logic in triggers
Metadata API recency
Multiple triggers per object
Nested IFs
Number of arguments per method
Number of methods per class
Send email in loops
Inefficient calls to Schema.getGlobalDescribe
Use of spaces in attribute class selectors
Naming conventions on Aura Controller Property
Naming conventions on Apex inner classes
Naming conventions on Apex test classes
Naming conventions on Apex test inner classes
Naming conventions on sObjects
Naming conventions on sObjects fields
Naming conventions on Apex classes
Naming conventions on Apex triggers
Naming conventions on Apex methods
Naming conventions for Apex variables
Inactive flows and processes
Nulls/Empty checks after lookups in Flows
Inactive validation rules
Objects with an excessive number of custom fields
High complex flows and processes
High complex Apex methods
High complex Apex files
Use of outdated API version for ICU locale
Scan PRs only when destination is a tracked branch
Retirement of AccountInsights and OpportunityInsights Settings
Retirement of Streaming API versions
Deprecated methods in URL Class
Deprecated SiteSettings
Changed behaviour on Type.forName
Retirement of Salesforce Functions
JsonAccess Annotation
Use of deprecated list view resources
Use of retired Workflows and Process Builders
Missed opportunity: Static SOQL for Data Cloud DMOs
Untested Flows
Missed opportunity: defaultValue and placeholderText modifiers
Use of JavaScript in WebLinks
Breaking change in LWC host access
Breaking change in LWC import and export statements
Breaking change in LWC style access
Missed opportunity: Null Coalescing Operator