Salesforce Rules
- Avoid Maintaining Legacy Code With Outdated API Versions
- Avoid Using Function SObjectType.getDescribe In FLS Checks
- Avoid Importing Multiple JavaScript Files Individually
- Avoid Using Outdated API Versions In New Code
- Avoid Using Data Grids
- Avoid Importing Multiple CSS Files Individually
- Avoid Using An Excessive Number Of Images
- Component Id Must Be Unique
- Page Names Should Always Begin With An Upper Case Character
- Use Custom Components To Lazy Load Data In APEX Pages
- Static Resources Should Be Used To Serve JavaScript, CSS And Images
- Action Pollers Should Not Use Short Polling Intervals
- Avoid Displaying The Results Of Unbounded Queries On A Page
- Avoid Importing Images From Sources Other Than Static Resources
- Avoid Using More Than One Tag Per Page
- Avoid Importing CSS And Javascript Files From Sources Other Than Static Resources
- Use The Render Attribute To Update The Component
- Optimize HTML By Removing Unnecessary HTML
- Optimize Javascript
- Avoid Custom Fields Without Description Or Help Text
- Avoid Defining Multiple Triggers Per Object
- Avoid Defining More Than One Trigger Per Object – Medium
- Avoid Excessive Sharing Rules On An Object
- Avoid Formula Fields With JavaScript Code
- Avoid Inactive Validation Rules
- Avoid Objects Without Indexed Fields
- Ratio Custom Fields To Total Fields In Standard Objects – Low
- Avoid Objects Without Picklist Fields
- Avoid Free Entry Custom Fields With No Data Restrictions
- Avoid Excessive Validation Rules
- Ratio Custom Fields To Total Fields In Standard Objects – High
- Avoid Hardcoded URLs
- Avoid Unreachable Code
- Ratio Custom Fields To Total Fields In Standard Objects – Medium
- Bounded Relative Date Values Should Be Used Whenever Appropriate
- Details Should Not Be Shown By Default
- The “contains” And “does not contain” Filter Operators Should Not Be Used
- The number of fields on a Report should be kept to a minimum
- The “or” Operator Should Not Be Used
- The Show Filter Should Not Contain The “All” Option
- Unbounded Time Intervals Should Not Be Used
- Unused Report: Last Run Over Two Years
- Unused Report: Last Run From 1 To 2 Years
- Unused Report: Last Run From 90 Days To 1 Year
- Avoid using apex:includeScript
- Avoid Using HTML Tags Which Will Be Removed By The VisualForce Page
- Include JavaScript Code From Static Resources
- Avoid Using The File Download Servlet To Reference Static Resources
- Use Of Open Source Javascript Framework
- Password Policy Complexity Too Weak – No Restrictions
- Password Policy Expiration Too Weak – Non-Expiring Passwords
- Password Policy Expiration Too Weak – Password Lifetime Over 90 Days
- Password Policy Repetition Too Weak
- Password Policy Max Login Attempts Too Wide
- Password Policy: Obfuscate The Secret Answer For Password Resets
- Password Policy: Password Question Requirement Set To None
- The Trusted IP Range Is Too Wide
- Password Policy Minimum Password Length Too Weak
- Ratio Of Custom Objects To Standard Objects – High
- Ratio Of Custom Objects To Standard Objects – Medium
- Ratio Of Custom Objects To Standard Objects – Low
- Too Many Apex Classes (Over 50 – Does Not Include Test Classes Or Downloaded Apps)
- Too Many Roles (Over 20)
- Too Many Branches On Role Hierarchy
- Too Many Custom Reports Over Used Objects
- Too Much Views Over Used Objects
- Too Many Profiles And Permission Sets
- Avoid Having More Than One Apex Trigger Per Object
- Too Many Reports And Views Without Folder Assigned
- The Percentage Of Asynchronous Classes Is Too High
- The Instance Has More Than 5.000 Lines Of APEX Code
- Coverage Of Unit Tests Is Less Than 75%
- Cross-Site Request Forgery (CSRF) Protection On GET Requests On Non-Setup Pages Is Disabled
- Cross-Site Request Forgery (CSRF) Protection On POST Requests On Non-Setup Pages Is Disabled
- Clickjack Protection For Non-Setup Salesforce Pages Is Disabled
- Clickjack Protection For Customer Visualforce Pages With Standard Headers Turned On Is Disabled
- Clickjack Protection For Customer Visualforce Pages With Standard Headers Turned Off Is Disabled
- Clickjack Protection For Setup Pages Is Disabled
- The Browser Is Not Prevented From Inferring The MIME Type From The Document Content And From Executing Malicious Files
- Cross-Domain Session Information Is Exchanged Using A GET Request Instead Of A POST Request
- Protection Against Reflected Cross-Site Scripting Attacks Is Disabled
- The IP Addresses In Login IP Ranges Are Enforced Only When A User Logs In
- There Is No Sessions Time Out For Inactive Users
- Visualforce, Salesforce Sites, Or Communities Must Use HTTPS
- Prevent Unauthorized Used Of Session ID
- HTTPS Is Not Required To Log In To Or Access Salesforce
- Session Policy – Enable Content Security Policy
- Inactivity Time Warning
- There Are Free Entry Custom Fields With No Data Restriction
- Convert Attachments To Files
- Password Policy Password Hint Contains Password
- Password Policy Complexity Too Weak – Alphanumeric Restriction Only
- Password Policy Expiration Too Weak – Never
- Password Policy Expiration Too Weak – Six Months
- Password Policy Expiration Too Weak – One Year
- Password Policy Max Login Attempts – Unlimited
- Password Policy: Obfuscate The Secret Answer
- Avoid Using The Attachments Object
- Avoid Picklist Fields With Too Many Values
- Naming Convention For Salesforce
- Avoid Catch Block With Just Logs
- Avoid Configuration Elements Without “description”
- Avoid Return Statements In try/catch Finally Blocks
- Avoid using size() in SOQL queries.xg
- Exception Classes Should Extend an Exception
- Avoid Using HTTP Referer Headers
- Avoid Messaging Operation In Loop
- Avoid Async scheduling or queueing Operation In Loop.
- Avoid invocation of future methods inside loops
- Avoid throwing exception inside finally block
- Switch Statements Should Have a When Else Case
- Avoid Losing Exception Information
- Avoid duplicate queueable jobs
- Set maximum depth for chained queueable jobs
- Avoid using Tab Characters Check
- Set minimum queueable delay for chained queueable jobs
- Avoid multiple unary operators
- Avoid using Workflow Rules
- Avoid spaces in Omniscript elements
- Avoid too many elements in Omniscripts
- Avoid large Omniscript
- Avoid Record-triggered flows without entry criteria.
- Avoid inactive flows.
- Avoid DML statements in Flow-Loops.
- Avoid DML statements without error handling
- Avoid using UserInfo.GetSessionId()
- Avoid custom applications without logo