All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

2
votes
0answers
24 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
1
vote
1answer
33 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
4
votes
1answer
55 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
5
votes
2answers
21 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
8
votes
1answer
55 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...
2
votes
1answer
40 views

Salesforce periodic security review process

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan ...
1
vote
0answers
38 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
0
votes
1answer
12 views

Change aesthetic things in an app package

Suppose I have an app ready to deploy to the AppExchange. It just passed the Security Review, but I see that there are minor changes like a field's, object's or tab's label/name. Such change could be ...
4
votes
0answers
40 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
8
votes
2answers
397 views

What would really happen in the security review before listing our app in AppExchange?

we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist. Now, we are ...
1
vote
1answer
64 views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
2
votes
1answer
38 views

Security scan of salesforce gives 'Test Methods With No Assert' for doInvoke() method of WebServiceMock Interface

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface. The 'doInvoke()' is not test method but it is a mock ...
4
votes
2answers
117 views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> ...
1
vote
2answers
54 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause ...
7
votes
4answers
678 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
1
vote
1answer
66 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
2
votes
1answer
44 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
2
votes
1answer
87 views

List of Low risk level issues that can be ignored with ZAP scanner

Are there any issues that can be ignored from ZAP scanner results? I know there is a thread here on issues that can be ignored in BURP suite here. However, those issues are informational, but those ...
5
votes
1answer
763 views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
1
vote
1answer
19 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
1answer
59 views

Salesforce Security Review Error - Possible XSS / escape='false'

Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line $calEvent.find(".wc-time").html(calEvent.status+"<br/> <div ...
4
votes
1answer
117 views

Security concerns around site.login() StartURL parameter

I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards. The jist here is that user might be redirected to malicious ...
0
votes
1answer
31 views

Data Requirements for Security Review to test Web Services in a package

I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global ...
4
votes
2answers
724 views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server ...
1
vote
1answer
57 views

Already released Managed Package to AppExchange

I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go? Let's suppose that our clients are using our ...
1
vote
1answer
49 views

What is the meaning of this error message?

I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review. Here is the message ...
2
votes
1answer
167 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
1
vote
2answers
80 views

Prepopulate fields in edit mode and passing security review

I'm looking at publishing an application on AppExchange - most of this application is built using point-and-click, no APEX was needed for the first releases. There is a couple of fields that I want to ...
3
votes
2answers
123 views

Is data transfer between Salesforce and Heroku secure?

I wanted to check how secure is data transfer between salesforce and heroku. Is there any encryption mechanism built in when we integrate salesforce and Heroku (when data transfer occurs). Update - ...
1
vote
2answers
1k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this ...
0
votes
1answer
49 views

Submit app for Review

I want to publish my app on appexchange in order to do so i need to review, So while submitting my for review i am getting error at step 5. salesforce is asking for production/sandbox credentials. I ...
5
votes
2answers
133 views

Security review: After every update?

Do I need to submit my package for security review after every bug fix/version upgrade? My first package was reviewed by security, however I did not make the listing public. Now, my latest package ...
0
votes
1answer
47 views

AppExchange Security Review of Client

We are planning to release an offering to AppExchange. Our offering includes clients which interacts sfdc endpoints. However, the client does not interact with gzip encoding. Will it be an issue for ...
2
votes
1answer
707 views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
0
votes
2answers
94 views

Cloud security scanner issues?

I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
2
votes
1answer
506 views

Burp suite rest webservice callout

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. ...
3
votes
1answer
213 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
1
vote
1answer
1k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
3
votes
2answers
279 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
1
vote
1answer
101 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
2
votes
1answer
99 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link ...
4
votes
1answer
109 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
1
vote
3answers
40 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
3
votes
2answers
2k views

How to prevent caching in Cache.db-wal file in iOS App which contain Salesforce iOS SDK

My iOS App rejected by Salesforce security review team with following reason. "Insecure Storage of Sensitive Data" and show this file path ...
0
votes
1answer
90 views

Force.com Security Scanner Results - Frame Spoofing for Survey force application

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages: ...
0
votes
1answer
76 views

How to install package in mobile devices through salesforce1 application or any other way

I have developed an application in a salesforce account. and I have created the package and can publish on the appexchange. Now, that uploaded application on the appexchange can be installed in ...
1
vote
1answer
26 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
1
vote
1answer
65 views

Managed Base and Extension Packages and the AppExchange: How to deal with Licenses and Security Reviews

A recent question had basically two different answers regarding the usage of features, which might not be available at the target org: Adress the feature in question in a soft way. E.g. use the ...
2
votes
0answers
201 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
0
votes
1answer
272 views

Changing callback url in connected app & security review

We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. ...