I have used Checkmarx, Code Scan and PMD for code scanning for Apex and Visualforce Pages.

I would like to know if there is any such tool for scanning Lightning components (Aura & Web)?

As part of our security process, there is a mandate to scan the code to ensure that there are no critical issues before putting the code base into production org.

There is a need for to invoke this scan process via CD process.

Please share the details, if any.


Lightning is "Secure By Design" (almost frustratingly so, in fact). As such, I'm not sure that there would be any demand for a scanner to detect "vulnerabilities." If you could find an actual vulnerability, it would most likely be a bug you'd need to report to Salesforce. Aside from scanning Apex for security vulnerabilities, there's no additional need to scan Lightning itself. Of course, you should still be writing unit tests to avoid any logic bugs, but they would not be security vulnerabilities as opposed to simple errors that prevent the component from running correctly. Also, there's already a server-side linter that verifies correct code (both markup and script) before uploading, thus further reducing the need for an offline checker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.