I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface.

The 'doInvoke()' is not test method but it is a mock interface method which is used to mock the SOAP API-Callout.

Also there is a getter/setter variable in test class, for that also i got 'Test Methods With No Assert'.



private class ABC {

    static BV_Behavior_Mapping__c bm {get; set;}    
//got 'Test Methods With No Assert' for this variable


Does anyone know why security scan gives 'Test Methods With No Assert' for method 'doInvoke() and getter/setter variable?

1 Answer 1


Thats called false positive .Ideally just to keep Checkmarks Scanner happy you can write below in methods which scanner has caught without asserts just to keep Checkmarks Scanner happy


Scanner just looks for all apex and sees if no assert found just throws exception

  • 3
    Or... Don't worry about it. If it's for an appexhange app, the security team can tell it's a false positive.
    – sfdcfox
    Jan 27, 2016 at 15:02
  • 1
    I think that you can just justify it to the security team in a written explanation
    – mkorman
    Jan 27, 2016 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .