2

I want to submit a package for security review, and Checkmarx in the Partner Security Portal has been unavailable for some time.

enter image description here

At this point, I can either keep trying to resolve why it doesn't work with Salesforce, OR use the scanner at the Customer Portal to scan my org with the unmanaged code deployed.

From other StackExchange posts like this one, it's clear to me that the recommendation by Salesforce is to use the Partner portal's scanner as it's a managed package.

  1. Would both scanners return the same vulnerabilities? (Even if one analyses the unmanaged code and the other the package)
  2. Would Salesforce review team accept both reports?
Improve this question
4
  • 2
    The customer security scanner scans unpackaged metadata in a given org while the partner security scanner scans the metadata that is part of a managed package (beta or release) version. You cannot submit a customer security scanner scan for security review. The problem you have is probably related to how you have set up your user account used for reviews and could be a result of the changes made when the partner portal switched to trailblazer.me. The security portal actually uses a different set of credentials in my experience.
    – Phil W
    Commented May 5, 2023 at 7:57
  • 2
    I recommend you raise a support case about your inability to generate scans. Note that the use of PMD in the meantime should help you out. This, at least, will report all errors it finds instead of a subset of the errors (which is what you get from Checkmarx - it only reports up to 500 issues of any given type).
    – Phil W
    Commented May 5, 2023 at 7:59
  • Thank you @PhilW, I see that going to security review with the customer portal's scan is not an option then. Do you know the specific differences regarding vulnerabilities scanned? (Independently of scanning a package vs unmanaged code).
    – Manuel Moya
    Commented May 5, 2023 at 8:04
  • 2
    I don't which is why I didn't answer, just commented. Regardless, use PMD as your way to find security issues before submission while waiting for help from support (after you raise that case). It should get most of what Checkmarx does, and then some. NB: Chatter on partner forums suggests the security team at Salesforce have started using PMD themselves during the review process.
    – Phil W
    Commented May 5, 2023 at 8:09

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .