Rules

Rule	Default	Catches
webapi-wildcard-fields	error	Web API enabled with * as the fields list
webapi-no-permission	warning	Web API enabled on a table no table permission covers
webapi-inner-errors	warning	Web API errors that include the inner error
setting-secret-value	error	Secret site setting (ClientSecret, …) with a value of its own
permission-no-role	warning	Table permission with no web role
global-write-anonymous	warning	Global create, write or delete for Anonymous Users
global-write-authenticated	warning	Global create, write or delete for Authenticated Users
parent-chain-broken	error	Parent-scope permission whose parent is missing, has no role, or loops
scope-relationship-missing	error	Contact, Account or Parent scope without its relationship
multiple-authenticated-roles	error	More than one role flagged as Authenticated Users
role-unused	info	Web role nothing uses
page-rule-no-page	warning	Page access rule with no page, or a missing or inactive one
page-rule-no-role	error	Page access rule with no web role
page-rule-anonymous	error	Page access rule listing Anonymous Users, which lets nobody in
page-rules-conflict	error	More than one Restrict Read rule on a page
page-roles-not-subset	warning	Restrict Read role that a rule above keeps out
grant-change-overrides-read	warning	Grant Change role that reads past a Restrict Read
page-rule-authenticated	warning	Restrict Read listing Authenticated Users with other roles
page-parent-missing	error	Web page whose parent is missing or inactive, or loops

pageslens explain <rule> prints a rule’s page in the terminal, and pageslens explain lists the rules.

The page- rules and grant-change-overrides-read run on classic sites only (pac pages download). Where a rule’s default names two severities, a finding gets the one that fits it, unless the config sets the rule’s severity.

Change a rule’s severity, or turn it off, in pageslens.config.yaml:

rules:
  global-write-anonymous: error
  role-unused: off

The file is found in the folder you lint or any folder above it; --config <file> points at another one.