Code references

Flagdeck can track where each flag is used in your code, so you always know whether a flag is still wired up, and when it is safe to delete.

This is the other half of release safety. A flag makes a risky change easy to ship and easy to turn off, but flags also pile up. A flag with no runtime traffic and no references left in your code is dead weight, and Flagdeck can tell you that with confidence.

What gets sent

Scanning runs where your code lives, in CI or on your own machine, and sends only metadata: the file path, line number, and commit SHA for each match, plus the flag keys it found. Your source code never leaves the machine. Only files tracked by git are scanned, so your .gitignore is respected.

How it works

• References are tracked per repository and per branch. Each scan replaces the references for that one branch, and branches that no longer exist on the remote are pruned on the next scan.
• One branch is the source of truth for the "safe to remove" verdict: your default branch (for example main). References on a short-lived feature branch do not keep a flag alive.
• Flagdeck also detects extinct flags: keys that were removed from code in recent commits, so a flag that was just deleted from the codebase is surfaced for cleanup rather than silently dropped.

Safe to remove

A flag is marked safe to remove when all of these are true:

• it has no runtime traffic in the activity window,
• its default branch has been scanned recently, so "no references" is trustworthy, and
• it has zero references on that default branch.

You control the traffic window and the staleness thresholds per project from Project settings, under Flag lifecycle.

Setting it up

There are three ways to report references, and you can mix them:

1. GitHub Action (recommended). Scan on every push to your default branch so "no references" stays current. See the CLI guide for the workflow file.
2. CLI. Run flagdeck scan locally or in any CI. See the CLI guide.
3. MCP. Coding agents can report references through the report_code_references tool on the MCP server.

Reading references in the app

Open any flag and find the Code references card. It shows where the flag is used, a per-branch breakdown, and, when the flag qualifies, a Safe to remove badge. The project Overview groups the flags that need attention, including the ones that are safe to retire.