Apex code quality and configuration drift

100 %: inside your org
0: outbound data by default
71: controls self-assessed out of 255 catalogued
10 min: to install

The French text governs. This page is the English version of Code et configuration FR.

15 capabilities that treat your org as a codebase: what it contains, what has degraded in it, and what changed since the last time you looked. What the Discovery offer opens among them: none.

15: capabilities in this family
0: active on installation day, on the Discovery offer
Any paid plan: entry tier of the family

What this family measures

OrgGuardian Configuration drift screen: drift events over seven days, drifting components and an observation window per component. — **Configuration drift screen.** Every tracked component, its changes over three weeks, and the finding it opened. Demo data.

Two angles, in the order of the table — word for word, the two sub-headings you will find below, row by row.

Code: the linters read Apex, Visualforce, metadata and — through the Tooling API — the declarative LWC and Aura surface, looking for the patterns a Security Review punishes: a query without USER_MODE, unescaped output, unsafe DOM. Add to that a technical-debt score and test coverage, measured through the Tooling API: as long as the TOOLING_API_DISCOVERY read stays closed — its state at install —, the indicator shows “not measured” with its cause, never 0%. Findings emitted: CodeQuality:ApexLint, CodeQuality:VfLint, CodeQuality:MetaLint, CodeQuality:Coverage, CodeQuality:TechDebt.
Configuration: a fingerprint is taken at every scan, and drift is read against it. The detail goes down to the field — “modifyAllData went from false to true” rather than “the fingerprint moved” — and the time machine rebuilds the state at a past date from the fingerprints already kept: no new capture, no new storage. The dependency graph answers the question that precedes every change: who breaks if I touch this?

The 15 capabilities, one by one

Capabilities of the family, their minimum offer and their state at install.
Capability	Minimum offer	At install
Code
Code-quality linters`CodeQuality_Linters`	Any paid plan	—, display tier: nothing to toggle, the offer is enough
Technical-debt analysis`CodeQuality_TechDebt`	Any paid plan	—, display tier: nothing to toggle, the offer is enough
LWC and Aura XSS linter`CodeQuality_Declarative_Lint` · the LWC / Aura source is readable only through the Tooling API: detector open and read closed is a real state, and the finding says so instead of going quiet	Any paid plan	Closed
Findings for drift from the approved baseline`Config_Baseline_Findings` · configuration drift against the baseline becomes findings; a gate distinct from the screen, which the detector ALSO requires: an org that only opened the screen emits nothing	Any paid plan	Closed
Deployment advisor (CI check)`Deploy_Advisor` · it does not read the deployment, talks to no Git repository, analyses no diff and blocks nothing	Any paid plan	Closed
Apex scanner`Apex_Scanner`	Any paid plan	Open
Tooling API discovery scanners`TOOLING_API_DISCOVERY` · off at install: it consumes your API quota through a self-call through a named credential, never the session token, and it is waiting for the OS_SelfOrg named credential to be wired. It is not a capability sold in this family: it is the read path of capabilities sold elsewhere, so it does not set the family’s entry offer	Discovery	Closed
Configuration
Config drift`Config_Drift`	Any paid plan	Open
Drift from the approved baseline`Config_Baseline_Drift`	Any paid plan	Closed
Changed settings detail`Config_Field_Delta`	Any paid plan	Open
Config state at a past date`Config_Time_Machine` · rebuilt from fingerprints already kept: no new capture, no new storage	Any paid plan	Closed
Config & posture export`Config_Export`	Any paid plan	Closed
Config dependency graph (Security)`Config_Dependency_Graph`	Any paid plan	Closed
Field-level configuration change ledger`Config_Change_Ledger` · stores a configuration fingerprint only, never the raw setting value	Any paid plan	Closed
Sandbox and production parity`Sandbox_Parity` · outbound flow to a destination you choose, with your credentials	Any paid plan	Closed

— display tier: nothing to toggle, the offer is enough

Source: read from the package code at the moment this page is built — FeatureGate.FEATURE_TIER for the offer, FeatureGate.CODE_DEFAULTS for the state at install, and for the label the full resolution of FeatureToggleAdminController: the enablement guide’s catalogue first, the GateLabels custom labels next, and failing that the technical name as is. The editor’s labels — the whole column, not just that fallback — ship in English: master language en_US, and the package carries no translation file: these are the exact strings your administrator reads in the feature editor, and the site build fails if any of these lists moves without the others. “Closed” does not mean absent: the capability is shipped, it is waiting for a human to open it inside the org — and a capability whose implementation nothing in the package can reach appears on none of these pages: the build drops it instead of selling it.

What this family does not do

It does not replace Salesforce Code Analyzer. Ours runs inside the delivered org, continuously, on what is actually deployed there — not on a branch in a CI pipeline. The two do not measure the same thing and complement each other.
It changes neither your code nor your configuration, and proposes no automatic fix.
The declarative linter depends on the Tooling API. Detector open and read closed is a real subscriber state: the product then emits a finding that names it, instead of letting you believe the sweep found nothing.
Drift is read against the previous fingerprint, not against an approved baseline you never filed.

The other families

Discovery 38 capabilities Monitoring 14 active on installation day Limits, health, failed logins, async queues, outbound endpoints, Event Monitoring logs. Discovery 39 capabilities Security 2 active on installation day Privileges, sharing, guests, OAuth, bulk export, API exfiltration, login anomalies. Any paid plan 5 capabilities Compliance none active on installation day Findings mapped to eight frameworks, signed attestation, board report. Discovery 28 capabilities Alerts 3 active on installation day Alerting without drowning: deduplication, grouping, escalation, quiet hours, external channels. Discovery 7 capabilities Integrations 1 active on installation day Read REST API, SIEM export, ITSM integration, Agentforce actions.

Is this family in your offer? The grid says so line by line.

See the pricing grid Back to the seven families