I have used Checkmarx, Code Scan and PMD for code scanning for Apex and Visualforce Pages.

I would like to know if there is any such tool for scanning Lightning components (Aura & Web)?

As part of our security process, there is a mandate to scan the code to ensure that there are no critical issues before putting the code base into production org.

There is a need for to invoke this scan process via CD process.

Please share the details, if any.

2 Answers 2


Lightning is "Secure By Design" (almost frustratingly so, in fact). As such, I'm not sure that there would be any demand for a scanner to detect "vulnerabilities." If you could find an actual vulnerability, it would most likely be a bug you'd need to report to Salesforce. Aside from scanning Apex for security vulnerabilities, there's no additional need to scan Lightning itself. Of course, you should still be writing unit tests to avoid any logic bugs, but they would not be security vulnerabilities as opposed to simple errors that prevent the component from running correctly. Also, there's already a server-side linter that verifies correct code (both markup and script) before uploading, thus further reducing the need for an offline checker.

  • What about scanning any custom Javascript? I think this is what the question is about. Like OWASP checks that perhaps the linter already does. The other question is whether Checkmarx will kick Javascript issues back, which I think it does scan for XSS for instance. If so, how can we run the same scans as part of our CI/CD process.
    – Shanerk
    Commented Oct 21, 2020 at 21:44
  • @Shane What sort of vulnerabilities are you worried about scanning for, out of curiosity?
    – sfdcfox
    Commented Oct 21, 2020 at 22:38
  • XSS, and the standard OWASP stuff.
    – Shanerk
    Commented Oct 22, 2020 at 15:34
  • It would also be nice to run a scan that tells you Locker "violations" for JS code that you are bringing in as a static resource, so you know what needs to be fixed to get it to work within Salesforce.
    – Shanerk
    Commented Oct 22, 2020 at 15:35

sfdx-scanner seems to cover all your needs (Apex, Aura, LWC)

To use it in CI/CD, you can include Mega-Linter in your pipeline (it includes sfdx-scanner + 70 other linters)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .