# PMD (Retired)

PMD is a source-code analyzer that allows for static analysis of code written in a number of supported languages, including Java, Apex, and Visualforce. Its built-in rules detect common flaws in code, such as empty catch blocks or unused variables.

## How Salesforce Code Analyzer Uses PMD

By default, the Code Analyzer `scanner run` command executes the PMD default Apex and Visualforce rules against compatible files.

You can change which rules are executed by using the flags described in the Code Analyzer Command Reference.

Refer to our [FAQ](/docs/platform/salesforce-code-analyzer/guide/faq.md#q-how-do-i-enable-engine-xs-default-rules-for-language-y) for info on how to enable the PMD built-in rules for other languages.

## Prepare Your Solution for AppExchange Security Review with pmd-appexchange

In addition to the base PMD engine, Code Analyzer also includes a custom PMD variant, `pmd-appexchange`. The rules included in `pmd-appexchange` helps you prepare your managed packages for security review.

The `pmd-appexchange` engine is disabled by default. To run a PMD scan with the AppExchange ruleset, run `sf scanner run` with the `--engine pmd-appexchange` flag. For example:

`sf scanner run --engine pmd-appexchange --target ./`

For more information on the `pmd-appexchange` rules, see the [pmd-appexchange Rule Reference](https://github.com/forcedotcom/sfdx-scanner/tree/dev/pmd-appexchange/docs).

To include an optional PMD scan with the AppExchange-specific ruleset in your AppExchange security review submission, run `sf scanner run --engine pmd-appexchange` and name the output file `CodeAnalyzerPmdAppExchange.csv`. For example:

`sf scanner run --engine pmd-appexchange --format csv --outfile CodeAnalyzerPmdAppExchange.csv`

For full instructions on preparing for the AppExchange security review with Code Analyzer, read [Scan Your Solution with Salesforce Code Analyzer](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm) in the ISVforce Guide.

## See Also

- [PMD](https://pmd.github.io/#home)
- [PMD 7 Release Notes](https://docs.pmd-code.org/latest/pmd_release_notes_pmd7.html)
- [PMD Copy-Paste Detector](https://docs.pmd-code.org/latest/pmd_userdocs_cpd.html)
- [pmd-appexchange Rule Reference](https://github.com/forcedotcom/sfdx-scanner/tree/dev/pmd-appexchange/docs)
- [PMD Customization](/docs/platform/salesforce-code-analyzer/guide/pmd-config.md)
- [Salesforce Code Analyzer Command Reference](/docs/platform/salesforce-code-analyzer/guide/code-analyzer-command-reference.md)
- [*ISVforce Guide*: Scan Your Solution with Salesforce Code Analyzer](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm)