Code and configuration

100 %: inside your org
0: outbound data by default
71/255: controls self-assessed
10 min: to install

The French text governs. This page is the English version of Code et configuration FR.

14 capabilities that treat your org as a codebase: what it contains, what has degraded in it, and what changed since the last time you looked. What the Discovery offer opens among them: none.

14: capabilities in this family
0: active on installation day, on the Discovery offer
Small business: entry tier of the family

What this family measures

Two angles, in the order of the table — word for word, the two sub-headings you will find below, row by row.

Code: the linters read Apex, Visualforce, metadata and — through the Tooling API — the declarative LWC and Aura surface, looking for the patterns a Security Review punishes: a query without USER_MODE, unescaped output, unsafe DOM. Add to that actually measured test coverage and a technical-debt score. Findings emitted: CodeQuality:ApexLint, CodeQuality:VfLint, CodeQuality:MetaLint, CodeQuality:Coverage, CodeQuality:TechDebt.
Configuration: a fingerprint is taken at every scan, and drift is read against it. The detail goes down to the field — “modifyAllData went from false to true” rather than “the fingerprint moved” — and the time machine rebuilds the state at a past date from the fingerprints already kept: no new capture, no new storage. The dependency graph answers the question that precedes every change: who breaks if I touch this?

The 14 capabilities, one by one

Minimum offer: Small business, on every row of this table

Capabilities of the family, their state at install. All have Small business as their minimum offer.
Capability	At install
Code
Code-quality linters`CodeQuality_Linters`	—, display tier: nothing to toggle, the offer is enough
Technical-debt analysis`CodeQuality_TechDebt`	—, display tier: nothing to toggle, the offer is enough
XSS linter of the declarative surface (LWC and Aura)`CodeQuality_Declarative_Lint` · the LWC / Aura source is readable only through the Tooling API: detector open and read closed is a real state, and the finding says so instead of going quiet	Closed
Deployment advice`Deploy_Advisor` · it does not read the deployment, talks to no Git repository, analyses no diff and blocks nothing	Closed
Apex scanner`Apex_Scanner`	Closed
Tooling API discovery`TOOLING_API_DISCOVERY` · off at install: it consumes your API quota through a self-call through a named credential, never the session token, and it is waiting for the OS_SelfOrg named credential to be wired	Closed
Configuration
Configuration drift`Config_Drift`	Closed
Drift from the approved baseline`Config_Baseline_Drift`	Closed
Detail of the changed settings`Config_Field_Delta`	Closed
Configuration state at a past date`Config_Time_Machine` · rebuilt from fingerprints already kept: no new capture, no new storage	Closed
Configuration export`Config_Export`	Closed
Configuration dependency graph`Config_Dependency_Graph`	Closed
Configuration change ledger`Config_Change_Ledger` · stores a configuration fingerprint only, never the raw setting value	Closed
Sandbox / production parity, security setting by security setting`Sandbox_Parity` · outbound flow to a destination you choose, with your credentials	Closed

— display tier: nothing to toggle, the offer is enough

Source: read from the package code at the moment this page is built — FeatureGate.FEATURE_TIER for the offer, FeatureGate.CODE_DEFAULTS for the state at install. The label is the one exception: the in-org feature editor is French only, so the English wording in this column was written for this site. Its French counterpart, on /produit/, is the exact string your administrator reads, and the site build fails if the two lists move apart. “Closed” does not mean absent: the capability is shipped, it is waiting for a human to open it inside the org — and a capability whose implementation nothing in the package can reach appears on none of these pages: the build drops it instead of selling it.

What this family does not do

It does not replace Salesforce Code Analyzer. Ours runs inside the delivered org, continuously, on what is actually deployed there — not on a branch in a CI pipeline. The two do not measure the same thing and complement each other.
It changes neither your code nor your configuration, and proposes no automatic fix.
The declarative linter depends on the Tooling API. Detector open and read closed is a real subscriber state: the product then emits a finding that names it, instead of letting you believe the sweep found nothing.
Drift is read against the previous fingerprint, not against an approved baseline you never filed.

The other families

Discovery 34 capabilities Monitoring 10 active on installation day Limits, health, failed logins, async queues, outbound endpoints, Event Monitoring logs. Small business 35 capabilities Security none active on installation day Privileges, sharing, guests, OAuth, bulk export, API exfiltration, login anomalies. Small business 4 capabilities Compliance none active on installation day Findings mapped to eight frameworks, signed attestation, board report. Discovery 25 capabilities Alerts 3 active on installation day Alerting without drowning: deduplication, grouping, escalation, quiet hours, external channels. Discovery 6 capabilities Integrations 1 active on installation day Read REST API, SIEM export, ITSM integration, Agentforce actions.

Is this family in your offer? The grid says so line by line.

See the pricing grid Back to the seven families