All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry ...

learn more… | top users | synonyms

2
votes
1answer
11 views

What are some common reasons to fail a managed packaged security review?

Just looking for the top few things to watch out for. Can anyone recommend common mistakes or areas of concern?
1
vote
0answers
7 views

Security review with third party integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in ...
0
votes
0answers
24 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
4
votes
1answer
39 views

How to store sensitive data in Salesforce (for AppExchange package)?

I am developing AppExchange package, it contains integration with third-party webservice. I store credentials to this webservice in custom settings. After security review I received an email with ...
3
votes
1answer
46 views

Are external iframes in lightning experience kosher from a security review perspective?

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case. ...
3
votes
1answer
65 views

DOM modification feasibility in lightning

I want to implement Auto Compete in lightning, for this I have to use jQuery and jQueryUI and I have to directly modify DOM of component as well. Will it be allowed by the Salesforce ? Will is cause ...
1
vote
0answers
45 views

Firing event in renderer issue

I am using highcharts in my lightning components which is embedded in a lightning app. When clicking on the chart , I am firing an event. the method to draw the chart is called from renderer. And the ...
2
votes
0answers
29 views

Marketing cloud hubexchange app's security review

I recently hear the news that Salesforce is asking for the security review of hubexchange apps.I'm not sure this is only for security purpose or they are migrating the hubexchange apps to appexchange. ...
1
vote
1answer
40 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
4
votes
1answer
69 views

Stored XSS - Salesforce security check ( AngularJS) error

I am getting an error while security check Category : cross-site scripting , Stored XSS for below $scope.nameMap = {!nameMap}; For javaScript we have some encoding methos but i didn't found such ...
5
votes
2answers
33 views

What is the best way to include AES Encryption private key in a Managed App (with Security Review Passing)?

I'm trying to get an app pass Security Review, but the review team has identified that the key phrase being used is insecure storage mechanism. What I did was, I simply put the key in string ...
8
votes
1answer
94 views

Why is Security Review not passing app because of Weblinks containing JS code?

In latest development Salesforce Security Review team identified an issue with Javascript code in WebLinks. The exact statement that was provided in Security Report was: JavaScript of any type is ...
2
votes
1answer
45 views

Salesforce periodic security review process

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan ...
1
vote
0answers
66 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
0
votes
1answer
12 views

Change aesthetic things in an app package

Suppose I have an app ready to deploy to the AppExchange. It just passed the Security Review, but I see that there are minor changes like a field's, object's or tab's label/name. Such change could be ...
4
votes
0answers
67 views

How to Address DOM-based XSS from Security Review

I have a remoting function on my page that takes a list of contacts, and displays them in on Lightning Design styled page. It works fine, but the final innerHTML statement gets flagged in security ...
8
votes
2answers
410 views

What would really happen in the security review before listing our app in AppExchange?

we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist. Now, we are ...
1
vote
1answer
87 views

CRUD permission check Security Review with SOQL queries needed?

The CRUD permission check for Security Review has been imposed recently, though I'm clear on the DML statement and Create/Update/Delete permissions I need to check for in my code, but I'm not clear ...
2
votes
1answer
42 views

Security scan of salesforce gives 'Test Methods With No Assert' for doInvoke() method of WebServiceMock Interface

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface. The 'doInvoke()' is not test method but it is a mock ...
4
votes
2answers
148 views

XSS : Rich textarea content security review issue when using escape=false

I am getting user input through textarea as richtext and storing in object : <div class="col-md-12"> <div class="col-md-12"> <div class="form-group"> <...
1
vote
2answers
58 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause Cross-Site-Scripting(...
7
votes
4answers
691 views

Genuine SOQL Injection issue or False Positive?

Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review. I have provided a slightly simplified version below. The Id I am querying for ...
1
vote
1answer
71 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
2
votes
1answer
47 views

Security Review Scanner help

I ran the checkmarx security scanner and I got 1 item flagged as a "Bulkify Apex Methods" but I'm not 100% sure I get what's the issue there. Here's a screenshot of the Checkmarx issue. Can you ...
2
votes
1answer
139 views

List of Low risk level issues that can be ignored with ZAP scanner

Are there any issues that can be ignored from ZAP scanner results? I know there is a thread here on issues that can be ignored in BURP suite here. However, those issues are informational, but those ...
6
votes
1answer
878 views

Lightning Components Do NOT Use React?

The combination of Lightning Component and React is NG? Is my understanding of this correct? https://developer.salesforce.com/page/Requirements_Checklist Use of third party MV * frameworks is not ...
1
vote
1answer
21 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
1answer
62 views

Salesforce Security Review Error - Possible XSS / escape='false'

Salesforce Security Review Error - Possible XSS / escape='false' : How to solve this issue for the below set of line $calEvent.find(".wc-time").html(calEvent.status+"<br/> <div style='font-...
4
votes
1answer
118 views

Security concerns around site.login() StartURL parameter

I was reading An Insiders Guide to Security Review and on page 17, point 10 noticed something called Unvalidated Redirects and Forwards. The jist here is that user might be redirected to malicious ...
0
votes
1answer
32 views

Data Requirements for Security Review to test Web Services in a package

I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global ...
5
votes
2answers
949 views

How Checkmarx works

Can someone please advise how Checkmarx/ Force.com Security Source Scanner will be performing code review Is code review happening within Salesforce servers or code get ported to Checkmarx server ...
1
vote
1answer
64 views

Already released Managed Package to AppExchange

I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go? Let's suppose that our clients are using our ...
1
vote
1answer
50 views

What is the meaning of this error message?

I got an unmanaged package from the developer. I installed it in the developer org. Created a managed package from the components and gave the managed package for security review. Here is the message ...
2
votes
1answer
187 views

Security review sample “False positive document”

We are submitting our app for security review. We have an ASP.Net web application that consumes few Salesforce APIs. The Burp scanner raised few OS, Ruby, Python and PHP injection errors. But we don't ...
1
vote
2answers
85 views

Prepopulate fields in edit mode and passing security review

I'm looking at publishing an application on AppExchange - most of this application is built using point-and-click, no APEX was needed for the first releases. There is a couple of fields that I want to ...
3
votes
2answers
136 views

Is data transfer between Salesforce and Heroku secure?

I wanted to check how secure is data transfer between salesforce and heroku. Is there any encryption mechanism built in when we integrate salesforce and Heroku (when data transfer occurs). Update - ...
1
vote
2answers
1k views

How to display custom HTML in my Visualforce Page

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this <apex:...
0
votes
1answer
49 views

Submit app for Review

I want to publish my app on appexchange in order to do so i need to review, So while submitting my for review i am getting error at step 5. salesforce is asking for production/sandbox credentials. I ...
5
votes
2answers
138 views

Security review: After every update?

Do I need to submit my package for security review after every bug fix/version upgrade? My first package was reviewed by security, however I did not make the listing public. Now, my latest package ...
0
votes
1answer
47 views

AppExchange Security Review of Client

We are planning to release an offering to AppExchange. Our offering includes clients which interacts sfdc endpoints. However, the client does not interact with gzip encoding. Will it be an issue for ...
2
votes
1answer
775 views

Informational Issues in BURP Scan Report

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough ...
0
votes
2answers
101 views

Cloud security scanner issues?

I submitted a scan yesterday : http://security.force.com/security/tools/forcecom/scanner Normally, I get an email informing me that the scan is put in the queue and then another mail to give me the ...
2
votes
1answer
589 views

Burp suite rest webservice callout

We have been asked to do a BURP Scan of our Salesforce app during security review. Our application is built completely on Force.com platform but we have 1-2 REST webservice calls to external server. ...
3
votes
1answer
243 views

Is it possible to package a Canvas app where the Canvas App URL differs on a per-install basis?

We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how ...
1
vote
1answer
1k views

How do I fix Stored XSS and Reflected XSS?

When submitted my code for force.com scanning, I got a few error in the report which are "Reflected XSS and Stored XSS". So, would like to know if these are due to the usage of "jQuery, javascript and ...
3
votes
2answers
298 views

Security review for paid apps in appexchange

I want send my app to security review of appExchange. Is the Burp Report Compulsory? Thanks in advance
1
vote
1answer
108 views

Salesforce Security Review for composite app

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I ...
2
votes
1answer
105 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link https://developer.salesforce.com/page/...
4
votes
1answer
110 views

Security Scan/Report for iOS SFDC Product Review

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application. ...
1
vote
3answers
41 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...