All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

1
vote
0answers
11 views

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability: <script>var trueOrFalse = ...
1
vote
1answer
28 views

Security Review Step 5 issue

I've reached Step 5 of the Security Review submission for my new Managed Package. I've created a new Developer Org, installed the package and then proceeded to continue with the review. At step 5, ...
4
votes
1answer
38 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
4
votes
1answer
79 views

“inputText_Ignoring_FLS” in force security scanner report

I scan my code, and I received a Serious issue: <apex:inputText value="{!ld.Name}" /> I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS ...
4
votes
2answers
68 views

SalesForce Package Distribution Scenarios

I am writing an adapter for SalesForce which functionality will be to post information about particular events happened in the CRM to the external WebService. While I think I understood development ...
11
votes
1answer
231 views

How does Salesforce classify an app as 'Salesforce1 ready'?

As part of the Salesforce1 announcement, Salesforce showcased a list of apps on AppExchange that are 'Salesforce1 ready'. This includes several popular apps such as Box, Concur etc. I want to know how ...
3
votes
1answer
104 views

Security review for free apps in appexchange

We have created one app and planning to list in appexchange as free app. Do we need to pass security review, if yes then is it free or paid?. We have partner developer org to list in Appexchange.
3
votes
2answers
471 views

Managed app installation on Salesforce Production Org

Salesforce has two versions of Managed app Managed App ( Beta ) Managed App ( Released ) Currently inorder to do a prototype testing I released a Managed App (Beta) and simulated how a real ...
1
vote
0answers
62 views

SF Security Review Questioner - single org solution vs hybrid single org solution

I came across this question in Salesforce Security Review Process. But I am not sure what to choose. Is your offering a single org solution of hybrid single org solution? Options: A : ...
2
votes
1answer
85 views

Free App for Paid Service

I'm working on getting an app listed on the AppExchange, and we are just about ready to go into the Security Review. We were wondering if it is going to be a problem that we sell our app for free on ...
1
vote
1answer
374 views

Cross-site Scripting (XSS) in security review.?

I am getting Cross-site Scripting (XSS) while scanning in force.com scanner.if i remove javascript there is no error..what to change in javascript code..please help its quite urgent...may be encode ...
2
votes
1answer
135 views

XSRF issue in security review..?

I am getting these from URL..when i submitted my app for security review. their report has XSRF error can some help me how to correct this...as i need to oid from the url.i could find any ...
6
votes
4answers
297 views

Cross-Site Request Forgery (CSRF) CWE

I have Following page: <apex:page controller="myclass" action={!clean}> </apex:page> and controller class as: public with sharing class myclass { public void clean() { ...
3
votes
1answer
306 views

Drag & Drop Upload Images to documents - Security Problems

We have developed a Drag & Drop multiple Image Upload with Html5, jQuery and the REST API. We are wondering what are the problems that this feature can bring up in the security review. Let me ...
0
votes
1answer
75 views

Running ApexClasses in PE with Security Review and Certification

I've a managed package which I would like to be installed in a Professional Edition. When I try to install the package in the PE, I get following error, of course my package has few ...
10
votes
2answers
110 views

Incomplete code blocks vulnerability

I've submitted my application for Security Review and I've got this problem in the report. I'm not sure how to fix it. Let's see the First case: I have some classes that don't have any code like ...
1
vote
1answer
464 views

How do I run burp scanner

How do I run burp scan? Do I have to buy a burp suite? What is partner license mentioned in this url?
2
votes
2answers
183 views

Sign up for partner portal

Creating partner portal is free. Please correct me if I am wrong. I want to start security review for a free application from my AppExchange profile but I can't do that before paying to salesforce. Is ...