vulkro-sf antipatterns

Finds Salesforce Well-Architected anti-patterns (AP-NNN): governor-limit risks, hardcoded IDs, empty catch blocks and other architecture issues. These are quality findings, kept separate from the security findings of vulkro-sf scan.

vulkro-sf antipatterns .
vulkro-sf antipatterns . --format sarif > antipatterns.sarif
vulkro-sf antipatterns ./npsp --exclude-namespace=npe01,npe03,npo02

Flag	What it does
[PATH]	SFDX project or Apex source folder. Default ..
--format <table|json|sarif|junit>	Output format. junit gives one test case per finding for CI runners. Default table.
--exclude-namespace <ns>	Extra namespaces the project owns, beyond sfdx-project.json. Quiets AP-028 and AP-029 on merged-package projects. Repeat or comma-separate.
--compliance <hipaa|pci>	Broaden the PII checks AP-015 to AP-017 with HIPAA Safe Harbor or PCI-DSS card-data identifiers. Repeat or comma-separate.
--no-cache	Force a full re-scan. Same as VULKRO_SF_NO_CACHE=1.
--cache-dir <path>	Where the incremental cache lives. Default ~/.vulkro/.

For the full rule list, run vulkro-sf checks --category quality or read Well-Architected anti-patterns. In table output the governor-limit rules are tagged (Resource Optimiser).

Per-project settings (disable a detector, add owned namespaces) go in .vulkro-sf.yml.

Suppress comments

Silence one finding without disabling its detector. The comment applies to its own line or the line directly below:

// vulkro: ignore AP-029
partnerpkg.Notifier.send(account.Id, 'created');

Use a comma list (vulkro: ignore AP-029, AP-013) or * for any rule. It works in Apex // comments and XML <!-- --> comments, case-insensitively.

Exit codes

Code	Meaning
0	No anti-patterns found.
1	Anti-patterns reported.
2	Error.

See also: Anti-patterns report format