ActionRank
Check your actions

Lightning Flow Scan

Actively maintained

Flow-Scanner/lightning-flow-scanner · MIT

A standalone Salesforce Flow analysis engine available as a CLI plugin, VS Code extension, and GitHub Action. Scans metadata for 20+ issues, including hardcoded IDs, unsafe contexts, inefficient DML operations, recursion risks, and more. Supports auto-fixes, rule configs, CI/CD integration, and UMD builds for flexible use.

★ 173 starsLast commit 13 days agoLatest vsx-v3.4.2
B
78
/ 100
Security 100Maintenance 96Popularity 44Reliability 34

Security signals

OpenSSF ScorecardNo data
SECURITY.md presentYes
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: Flow-Scanner/lightning-flow-scanner@f607cbcb60d0b13391c6071f4ed6f858d4bb799b # vsx-v3.4.2

Mutable tags like vsx-v3.4.2 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: Flow-Scanner/lightning-flow-scanner@f607cbcb60d0b13391c6071f4ed6f858d4bb799b # vsx-v3.4.2

Score breakdown

Security (35%)100
Popularity (20%)44
Maintenance (30%)96
Reliability (15%)34