vulkro-sf impact-flow
Predicts the reach of one changed file before you deploy it: which untrusted data flows it sits on, and how many components depend on it.
vulkro-sf impact-flow . --changed force-app/main/default/classes/AccountService.cls
vulkro-sf impact-flow force-app/main/default/classes/AccountService.cls --format json
It combines the project's source-to-sink taint flows with its cross-file reference graph. Use it in a pre-deploy or pre-merge gate, before sf project deploy.
| Finding | Meaning |
|---|---|
SF-PREDEPLOY-001 | The change sits on a tainted source-to-sink flow. |
SF-PREDEPLOY-002 | More downstream consumers depend on it than --fanout-threshold (high blast radius). |
It is static and best-effort. Dynamic SOQL built elsewhere, reflection, managed-package callers and live-org-only wiring are invisible, so confirm a "no impact" result against the org.
| Argument or flag | What it does |
|---|---|
[PATH] | SFDX project root, or the changed file itself when --changed is omitted. Default .. |
--changed <file> | The changed file to predict impact for. |
--fanout-threshold <n> | Dependents above which SF-PREDEPLOY-002 fires. Default 5. |
--format <table|json> | Output format. Default table. |
Exit codes
| Code | Meaning |
|---|---|
0 | No impact. |
1 | Impact found (SF-PREDEPLOY findings reported). |
2 | Error (unscannable path, unknown --format). |