Recently I ran a checkmarx scan and saw this issue

Query: Bulkify Apex Methods Using Collections In Methods

I don't understand why checkmarx is showing this issue in few places and not in all methods. Should I fix this, or can I add this in a false-positive report since I know I will be processing only one record per transaction? I would like to understand how checkmarx is evaluating for this issue. TIA.

Code Example:

public void test(Opportunity opp){
     Account a = selectAccounts(new Set<Id>{opp.AccountId}).get(0);
public List<Account> selectAccounts(Set<Id> accountIds){
    return [Select Id from Account where Id In : accountIds];
  • 3
    It'd be helpful if you could provide an example of the code it flagged with an edit. And even an example you're confused why it didn't flag but looks the same to you. Commented Jul 9, 2021 at 14:48
  • Using same piece of code twice inside different class.
    – Megha Goel
    Commented Jul 12, 2021 at 6:03

1 Answer 1


Two points:

  1. This is probably a coding practice/style warning which is not relevant to a security review (but that is worth addressing to make your code perform better);
  2. Checkmarx never flags all instances of the same issue (if you have many of them) because the report you get from Salesforce Checkmarx execution is truncated and only shows the first n instances of any given problem - you need to either run Checkmarx locally with your own license or use PMD (though I don't know if PMD covers this coding pattern).

Checkmarx is a static analysis tool and cannot know what volumes of data get passed to any given method when those methods receive collections or query collections of data. It can only look for patterns in the code itself and really has no understanding of data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .