AI code review for Salesforce belongs on every plan, not the premium tier

Short answer: Automated review reads the Apex, Flows and metadata in a change before it reaches an org, and flags what a human reviewer skims past: SOQL in loops, missing sharing and field-level security enforcement, hardcoded ids, tests that assert nothing, and profile edits that quietly widen access. It is only worth having if it runs on every change from every person. That is the whole argument against selling it as a premium add-on.

What does AI code review actually catch before a Salesforce deploy?

Three layers. Most teams only inspect the first one.

Apex and tests

• SOQL and DML inside loops, the governor limit failures that only surface at production data volume.
• Classes running without with sharing, and queries that never enforce CRUD or field-level security.
• Hardcoded record type ids, profile ids and other org-specific ids that break the moment the change moves to the next org.
• Empty catch blocks and swallowed exceptions.
• Test classes that execute the code but assert nothing, or lean on SeeAllData=true.
• Org coverage that clears 75% while the new class contributes none of it.

Flows and automation

• Get Records or DML elements sitting inside a loop.
• Missing fault paths, so a failure lands in front of the user as a raw error.
• New Flow logic on an object where an Apex trigger already does the same work.

Metadata and permissions

This is the layer generic code review tools miss, and it is where most production incidents actually start.

• Profile or permission set changes that grant ModifyAllData or ViewAllData.
• Field-level security opened as a side effect of something else in the same commit.
• Validation rules or triggers deactivated inside the diff.
• An org-wide default moving from Private to Public Read/Write.
• Deletions in the destructive changes that nobody asked for.

Salesforce ships part of this for free. Code Analyzer v5 unifies PMD, ESLint, RetireJS, a regex engine and a Flow scanner behind one command, and it can run the AppExchange security rules through a rule selector (Salesforce developer docs). It is a good floor. It is also a CLI, which means it reaches the people who already live in a terminal.

Why is a general purpose AI reviewer not enough here?

A general purpose reviewer reads the diff as text. It does not know which profiles exist in the target org, whether the field being exposed carries regulated data, or that the trigger it is reading also fires from a Flow. Salesforce review needs org context: what the change touches downstream, what the target org already has, and what the deployment is about to remove. Without that context you get tidy style comments on Apex and complete silence on the permission set.

What does code review cost in the Salesforce DevOps market?

Mostly, it is priced per person. Gearset sells Code Reviews as a product separate from its core DevOps plans, listed at $160 per individual contributor per month at the time of writing (Gearset pricing). Salesforce Code Analyzer is free but developer-shaped. Between those two sits the group that makes the majority of changes in a typical org: admins and consultants working in Setup.

Why does gating review behind a premium tier defeat the point?

A review gate is worth exactly as much as its coverage. Price it per contributor and three things follow.

• A budget owner gets a standing reason to license fewer contributors.
• The unlicensed contributors are usually the ones editing profiles, permission sets and Flows, the layer with the least review discipline to begin with.
• A check that inspects the developer branch and waves the admin change through is not a gate. It is a report.

The same logic applies to tier gating inside a single product. If the check that would have stopped a permission escalation sits on the plan above yours, the escalation still ships. Quality checks are either table stakes or they are theatre.

That is why Serpent puts AI code review on every plan, including the free Essentials tier, with unlimited users on all of them. Every change is read for governance drift, security issues, test coverage gaps and best practice violations before it deploys. Pricing is flat per company rather than per seat, so adding the admin who edits permission sets does not add a line to the invoice. To be precise about the metering: AI actions draw on the monthly credit allowance, which is 30 credits on Essentials.

How do you put review in front of the deploy?

1. Get every change into version control, including the ones made in Setup by people who never open Git.
2. Run the review on the diff rather than the whole org, so the output stays short enough that somebody reads it.
3. Make severe findings blocking and everything else advisory. A wall of warnings gets muted inside a week.
4. Treat metadata and permission findings as seriously as Apex findings.
5. Keep a human approval on the deploy itself. Automated review shortens the queue, it does not make the decision.

FAQ

Does AI code review replace human review?

No. It clears the mechanical findings so the human reviewer can spend their attention on business logic and design.

Can automated review catch security problems in metadata, not just Apex?

Yes, if the tool actually reads metadata. Profile, permission set, sharing model and field-level security changes are the findings most worth blocking on.

Is Salesforce Code Analyzer enough on its own?

It is a solid free floor for Apex, JavaScript and Flows. It runs from the CLI, so teams without developers usually need it wired into a pipeline that runs it on their behalf.

Should code review block a deployment or only warn?

Block on security and data-loss findings, warn on style. If everything blocks, people learn to bypass the gate entirely.

Does AI code review cost extra on Serpent?

No. It is on every plan including free Essentials, and AI actions draw from that plan's monthly credit allowance.