---
schema_version: "1"
id: b76205ec4064b3091491cc4b15faa4c71c8380932f23628855c9eb1ead328c66
title: PMD (Retired)
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/code-analyzer/salesforce-code-analyzer/guides/v3x/engines/pmd-engine.md
canonical_url: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/pmd-engine.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 1987c8589e624af19720746fd7293200f9bb15ebdcb62297dbd0ef626244dc2d
products:
  - Salesforce Code Analyzer
---
# PMD (Retired)

PMD is a source-code analyzer that allows for static analysis of code written in a number of supported languages, including Java, Apex, and Visualforce. Its built-in rules detect common flaws in code, such as empty catch blocks or unused variables.

## How Salesforce Code Analyzer Uses PMD

By default, the Code Analyzer `scanner run` command executes the PMD default Apex and Visualforce rules against compatible files.

You can change which rules are executed by using the flags described in the Code Analyzer Command Reference.

Refer to our [FAQ](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/faq.md#q-how-do-i-enable-engine-xs-default-rules-for-language-y) for info on how to enable the PMD built-in rules for other languages.

## Prepare Your Solution for AppExchange Security Review with pmd-appexchange

In addition to the base PMD engine, Code Analyzer also includes a custom PMD variant, `pmd-appexchange`. The rules included in `pmd-appexchange` helps you prepare your managed packages for security review.

The `pmd-appexchange` engine is disabled by default. To run a PMD scan with the AppExchange ruleset, run `sf scanner run` with the `--engine pmd-appexchange` flag. For example:

`sf scanner run --engine pmd-appexchange --target ./`

For more information on the `pmd-appexchange` rules, see the [pmd-appexchange Rule Reference](https://github.com/forcedotcom/sfdx-scanner/tree/dev/pmd-appexchange/docs).

To include an optional PMD scan with the AppExchange-specific ruleset in your AppExchange security review submission, run `sf scanner run --engine pmd-appexchange` and name the output file `CodeAnalyzerPmdAppExchange.csv`. For example:

`sf scanner run --engine pmd-appexchange --format csv --outfile CodeAnalyzerPmdAppExchange.csv`

For full instructions on preparing for the AppExchange security review with Code Analyzer, read [Scan Your Solution with Salesforce Code Analyzer](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm) in the ISVforce Guide.

## See Also

- [PMD](https://pmd.github.io/#home)
- [PMD 7 Release Notes](https://docs.pmd-code.org/latest/pmd_release_notes_pmd7.html)
- [PMD Copy-Paste Detector](https://docs.pmd-code.org/latest/pmd_userdocs_cpd.html)
- [pmd-appexchange Rule Reference](https://github.com/forcedotcom/sfdx-scanner/tree/dev/pmd-appexchange/docs)
- [PMD Customization](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/custom-configuration/pmd-config.md)
- [Salesforce Code Analyzer Command Reference](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/command-reference/code-analyzer-command-reference.md)
- [_ISVforce Guide_: Scan Your Solution with Salesforce Code Analyzer](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm)