A score only matters if a CFO can repeat it — especially when what’s being scored is AI-generated Salesforce code that already runs fine in a sandbox.
Finish Score is 0–100. Six dimensions. We run it on every Finish Audit so the conversation is not “your code is messy.” The conversation is a number, a band, and a verdict: keep, refactor, or rebuild.
This is the weighting. It is not a brochure. It is the rubric.
The six dimensions
| Dimension | Points | Why it is weighted that way |
|---|---|---|
| CRUD / FLS and secrets | 25 | Salesforce’s own Top-20 vulnerabilities writing has said object and field-level security is the top reason apps fail AppExchange Security Review, by a significant margin. Hard-coded secrets is a separate top-20 category. Both still “work” in a dev org. |
| Code Analyzer violations | 20 | Salesforce Code Analyzer v5 is free and assigns severity 1–5. We score severity-weighted density, not a raw count, so one Critical finding outweighs ten style flags. |
| Apex test coverage and assertion quality | 20 | Split 12 / 8 between raw coverage and whether the tests actually assert anything. 75% is the deploy gate. Coverage without assertions is a lie the platform will still accept. |
| AppExchange rule-selector pass rate | 15 | Only scored if a listing is a stated goal. Otherwise the 15 points redistribute pro-rata so every scorecard still resolves to 100. |
| CI/CD and source control | 10 | A leading indicator of future risk, not a current defect. It cannot outweigh a missing FLS check. |
| Documentation | 10 | Lowest on purpose. Missing docs make the next human expensive. They do not, by themselves, make the app unsafe to ship. |
When AppExchange is not in scope, dimension four drops out and its 15 points are redistributed across the other five. That keeps internal-app scores comparable to listing-bound scores.
What the bands mean
The scorecard produces a band as well as a number.
- Critical — remediation cost may exceed a clean rebuild. A Sprint only happens after the buyer confirms they want to keep the frame.
- At-risk — ship it and you are accepting incident risk, review risk, or both.
- Serviceable — the idea is sound. The last mile is scoped work, not a philosophical argument.
- Launch-ready — finish the remaining gaps and deploy, or go to Watch rather than a full Sprint.
We do not publish a public cutoff table with invented client scores. The first named Finish engagement with before-and-after numbers becomes a case study. Until then the rubric is the product, not a leaderboard.
When AppExchange is not in scope, dimension four drops out and its 15 points are redistributed across the other five. That keeps internal-app scores comparable to listing-bound scores.
What the bands mean
The scorecard produces a band as well as a number.
- **Critical** — remediation cost may exceed a clean rebuild. A Sprint only happens after the buyer confirms they want to keep the frame.
- **At-risk** — ship it and you are accepting incident risk, review risk, or both.
- **Serviceable** — the idea is sound. The last mile is scoped work, not a philosophical argument.
- **Launch-ready** — finish the remaining gaps and deploy, or go to Watch rather than a full Sprint.
We do not publish a public cutoff table with invented client scores. The first named Finish engagement with before-and-after numbers becomes a case study. Until then, the rubric is the product, not a leaderboard.
Why AI-Generated Salesforce Code Is Expensive to Trust
Give Claude a clear Salesforce requirement and it will give you something that runs.
That is the gift. It is also the trap.
The model optimizes for “runs in a scratch org as sysadmin.” It has no career riding on “survives a security review in a subscriber org.” So it writes queries that work for the builder. It does not write `WITH USER_MODE`. It does not think about the partner user, the community user, or the intern in sales. It will help you to 75% coverage with tests that insert a record, run the method, and assert that a record exists.
Congratulations. You have coverage. You do not have tests.
That is why CRUD / FLS / secrets carry 25 points and why assertion quality is eight points of the testing dimension instead of being hand-waved as “we hit 75.”
What the Audit actually hands you
People hear “audit” and picture a 40-page PDF nobody reads.
A Finish Audit is narrower than that.
In five to seven business days you get:
- Code Analyzer v5 run with the AppExchange rule selector when a listing is in play
- A keep / refactor / rebuild verdict
- A Finish Score, 0–100, on the six dimensions above
- A fixed-price quote for the Finish Sprint or the AppExchange build
The $4,500 credited if you book that next SKU within 30 days
It is a front door, not a souvenir.
Know your Finish Score before you know your problem.
What AI gets right — and why that is dangerous
Citizen developers should keep using the gift. Frame the objects. Frame the screens. Frame the happy path.
The danger is stopping at the gift.
“Runs” is not “finished.” “Covered” is not “tested.” “It works when I run it” is not a sharing model.
Sonar’s research on AI-generated code keeps making the same point in different words: most developers do not fully trust the output, and a large share of committed code now arrives from a model. Salesforce Ben’s 2026 technical-debt coverage is the ecosystem version of the same sentence. Label those as industry figures. They are not CloudFirst client results.
The handoff is the product. The model is not.
How to get a score
Finish Audit is $4,500 fixed. Remote. Salesforce-only. VS Code + Claude Code is the toolchain we already ship on — we pick up the repo rather than making you start over in ours.
Dream it. Frame it. Let an expert finish it.
FAQ
**Is Finish Score a Salesforce product?**
No. It is CloudFirst Labs’ rubric for AI-generated Apex and LWC apps. The underlying scanners (Code Analyzer v5, the AppExchange rule selector) are Salesforce’s.
**Why is documentation only 10 points?**
Because missing docs make the next engagement expensive. They do not, by themselves, fail Security Review.
**What if I do not want an AppExchange listing?**
Dimension four is skipped and its 15 points redistribute. The composite is still 0–100.
**Does the $4,500 apply to later work?**
Yes, if you book a Finish Sprint or Finish for AppExchange within 30 days.
Email john@cloudfirstlabs.com with “Finish Score” in the subject, or book a 20-minute Finish Audit call from the Finish page.
Built with AI. Finished by engineers.
About CloudFirst Finish
CloudFirst Finish takes a 20–90% built Salesforce app — Apex, LWC, Flow — and makes it documented, tested, and deployable. Finish Audit is $4,500 and five to seven days: a 0–100 Finish Score and a keep / refactor / rebuild verdict. Sprint, AppExchange packaging, and Watch sit behind that score. Prices and the ladder live on cloudfirstlabs.com/finish.
About CloudFirst Labs
CloudFirst Labs is a Tampa Salesforce consulting and AppExchange partner. The same bench that finishes AI-started apps is the bench that connects the Salesforce CRM, PSA, and billing systems MSPs run every day — ConnectWise, Autotask, ServiceNow, NetSuite, Certinia — so closed deals flow into delivery and invoices match what was sold. Co-founded by a former VP of Technology at a $200M MSP. We have lived the integration problems we still solve. Finish is the last 40% of an app. The MSP practice is the revenue engine those apps sit inside. Different jobs. Same production standard.
Need the MSP lane instead? Book an MSP Revenue Assessment.
Connect with John Dionne on LinkedIn and follow CloudFirst Labs for Finish and MSP systems writing, or browse more on the CloudFirst Labs blog.