All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

1
vote
1answer
11 views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
0
votes
2answers
18 views

Cloud security scanner issues?

I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
2
votes
1answer
14 views

Burp suite rest webservice callout

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. ...
1
vote
1answer
22 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
1
vote
1answer
95 views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
0
votes
0answers
18 views

Burp Suite Code Scan for 3rd party APIs

I am using close to 40 API web services (from a 3rd party provider) and am in the process of publishing the application I built using these API calls. I see that we got to submit the "Burp Suite scan ...
2
votes
2answers
109 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
1
vote
1answer
31 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
1
vote
0answers
30 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link ...
3
votes
0answers
29 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
1
vote
3answers
31 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
1
vote
1answer
202 views

How to prevent caching in Cache.db-wal file in iOS App which contain Salesforce iOS SDK

My iOS App rejected by Salesforce security review team with following reason. "Insecure Storage of Sensitive Data" and show this file path ...
0
votes
0answers
35 views

Force.com Security Scanner Results - Frame Spoofing for Survey force application

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages: ...
0
votes
1answer
43 views

How to install package in mobile devices through salesforce1 application or any other way

I have developed an application in a salesforce account. and I have created the package and can publish on the appexchange. Now, that uploaded application on the appexchange can be installed in ...
1
vote
1answer
17 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
1
vote
1answer
25 views

Managed Base and Extension Packages and the AppExchange: How to deal with Licenses and Security Reviews

A recent question had basically two different answers regarding the usage of features, which might not be available at the target org: Adress the feature in question in a soft way. E.g. use the ...
2
votes
0answers
33 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
0
votes
1answer
73 views

Changing callback url in connected app & security review

We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. ...
2
votes
2answers
156 views

How to write comments in APEX classes?

I'm wondering if there is a standard to write comments in APEX ? In order to pass the Security Review, I review my code. And I think writing good comments in APEX classes can help the reviewers to ...
3
votes
2answers
73 views

How to manage packages and extension packages

I want to deploy an application on the AppExchange and I need some explanations. My application contains several editions (Edition 1, 2, 3 and 4) with differents features. Superior edition contains ...
1
vote
1answer
113 views

How to run Burp web scanner for HTTP Callout?

I have submitted app for security review and they asked for Burp Scan Report. I have followed video tutorial but not get succeeded. Burp Scanner scan salesforce site instead of my HTTP Callout. ...
4
votes
2answers
521 views

Burp Scanner in Salesforce

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...
1
vote
0answers
27 views

Custom javascript is not allowed to run on Salesforce DOM [duplicate]

Recently i have created an app which uses custom JavaScript in sidebar home page component using custom links, The app works perfectly and i also uploaded it to appexchange as managed released package ...
2
votes
1answer
44 views

How to Use Custom Setting to Avoid Insecure Credential Storage Vulnerability?

I got a comment from Salesforce team about an insecure credential storage vulnerability saying that we must avoid hardcoding sensitive information and should use the custom settings. My situation ...
0
votes
1answer
134 views

Salesforce checkmarx security scan

Recently I put my code through the free checkmarx code scanner provided by salesforce. It gave me a stored XSS issue. But the piece of code which was identified has been in my codebase since a long ...
2
votes
1answer
54 views

new app still counting against object/tabs

New managed package just passed security review, tried installing into a test org and it still counts against object/tab limits in the org. Also still getting the notice when installing the app: ...
3
votes
1answer
119 views

Security Review - False Positive Document

I want to submit my app for security review. Since my App is calling some external API security review wizard is prompting to provide below details. Burp Scan report False positive document I have ...
5
votes
1answer
164 views

Direct API Calls from Visualforce Page

I am finding it pretty exciting to make webservice calls directly from visualforce + javascript. Specially with frameworks like Angular, you can directly consume JSON and render HTML templates pretty ...
1
vote
1answer
91 views

Tooling API and Scheduled Batch Apex - How to access

Without storing a users credentials to salesforce how can one access the tooling API during a daily scheduled batch? Currently we are storing the users username and password in encrypted fields but ...
1
vote
2answers
102 views

How to BURP test our outbound message endpoint?

We are using some workflows and trigger to send out outbound messages to a listening end-point of ours. We are going into a security review with SF and that requires some testing using BURP. What I ...
3
votes
2answers
171 views

How do I fix this Stored XSS?

The CheckMarx security scanner says that this line is a Stored XSS vulnerability <apex:column style="background-color:#{!trade.bgcolor};color:{!trade.fgcolor};"> is this HTMLENCODE the ...
1
vote
2answers
232 views

How do I fix this Reflected XSS vulnerability?

The CheckMarx security scanner says that this line is a Reflected XSS vulnerability. <apex:outputText value="0,number,#,##0.00}" style="color:!nost.balColor};"> However this page ...
6
votes
1answer
359 views

Get a FIRST-CLASS SessionID for API Calls (looking for a clean way or alternative)

I am basically facing the same challenge as @Evan here Different Session Ids in Different contexts I'm also running into SessionID related issues, but in a completely different use case. Background ...
1
vote
2answers
326 views

How do I fix this Stored XSS vulnerability?

The CheckMarx security scanner says that the 4th line: $j('#h{!category}').on('click', function(event) { in the following script, causes an XSS vulnerability. Can someone explain the best way to ...
0
votes
0answers
46 views

Push Major Upgrades before Security Review possible?

After logging a case to get Push Major enabled the Support refused it. They say its only available after security review. This beside of the lack of documentation this makes only halfway sense to ...
12
votes
3answers
567 views

How to pass security review when using “Without sharing” by design?

I failed to pass security review for an app that has two classes using the "without sharing" keyword. Both were not choosen accidentally but by design. On class is SObjectUnitOfWork.cls from Andrew ...
5
votes
1answer
126 views

Why did I fail Security Review when not checking FLS or using “without sharing”?

I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some ...
9
votes
2answers
134 views

Rolling back a managed released package?

We have a managed released package currently undergoing security review. While that is happening, we would like to make some changes to the tab layout of our application. Unfortunately, it seems that ...
6
votes
1answer
173 views

How to set a custom setting value in a managed package securely?

My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for ...
6
votes
0answers
48 views

Mini Page Layout Hovers in Managed Package

Has anyone using the mini page layout popup technique listed here in a managed package had the package rejected in security review because of it? This is obviously an unsupported technique, but given ...
9
votes
1answer
76 views

Metadata API usage in a managed package

If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on ...
1
vote
2answers
75 views

Salesforce security review

I am new to salesforce development and have a question regarding the application security review process. After the installation of my application in salesforce I want to invoke a service in my java ...
4
votes
0answers
131 views

Security Scanner finds XSS False Positives / JSENCODE incompatible with Boolean fields?

Before I submit my app for Security Review I checked it with the free scanner. It marked the following line of JS-code in a Visualforce as Critical XSS vulnerability: <script>var trueOrFalse = ...
1
vote
1answer
59 views

Security Review Step 5 issue

I've reached Step 5 of the Security Review submission for my new Managed Package. I've created a new Developer Org, installed the package and then proceeded to continue with the review. At step 5, ...
6
votes
1answer
179 views

Anyone have examples of genuine security issues identified by the Burp Scanner for external web services called via Apex?

Thanks to this blog post Using the Burp Suite to test a Web Service that is consumed in a Salesforce app I believe I have successfully scanned the two web services that my managed package calls. (This ...
4
votes
1answer
118 views

“inputText_Ignoring_FLS” in force security scanner report

I scan my code, and I received a Serious issue: <apex:inputText value="{!ld.Name}" /> I have applied FLS as the guide here : http://wiki.developerforce.com/page/Enforcing_CRUD_and_FLS ...
4
votes
2answers
197 views

SalesForce Package Distribution Scenarios

I am writing an adapter for SalesForce which functionality will be to post information about particular events happened in the CRM to the external WebService. While I think I understood development ...
13
votes
1answer
515 views

How does Salesforce classify an app as 'Salesforce1 ready'?

As part of the Salesforce1 announcement, Salesforce showcased a list of apps on AppExchange that are 'Salesforce1 ready'. This includes several popular apps such as Box, Concur etc. I want to know how ...
4
votes
1answer
292 views

Security review for free apps in appexchange

We have created one app and planning to list in appexchange as free app. Do we need to pass security review, if yes then is it free or paid?. We have partner developer org to list in Appexchange.
11
votes
1answer
599 views

BURP Scanning a managed package

Salesforce have asked me to do a BURP Scan on my managed package before I submit it to the AppExchange. My Managed Package is built on the Force.com platform. It does perform a couple of callouts to ...