we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist.

Now, we are waiting for the security review. We already used Force.com Security Scanner and scanned our code. There were few issues came out and we fixed that successfully.


In what ways the security review differs from what we did using the Force.com security scanner? Experts please suggest. Someone who have already posted their paid app in AppExchange had better experience and highly appreciable if they shared their thoughts.

Please note, we are in this process for the first time and our app is an Integration solution between Salesforce and SAP. Most of the stuff are callouts to SAP, VF pages and Apex classes. No triggers.


2 Answers 2


During the security review process ,following things are checked

1.Apex code Security best practices .Force.com scanner is good tool to point out any risks

2.All your end points will be BURP Scanned .If your application makes a call to external SAP url ,even SAP URL will be BURP Scanned to discover any potential threats .Note for partners BURP Scanner is available freely.

As a best pratice you should provide scanned reports to SFDC .The top ten OWASP(Open Web Application Security Project) security risks are examined

3.You can also use Chimera to scan your end points .Chimera avoids installation of any tool on your local machine and instead runs all on cloud .Preferred for only web apps at this point .

4.Security team reserves rights to randomly test your app functionality

The scope of security review is discussed here

Also the entire checklist is documented .

There are Security review FAQ's that should also help

Based on these scans you will receive one of the below

enter image description here

The entire process takes 6-8 weeks and you don't want to wait again for 6-8 weeks and go through second time .So make sure you have all documents ready .There also other paper works like enrolling to ISVForce and having a policy template

Dont forget to have a fully documentation of your solution offering along with a test org showing end to end on how your solution works


Have you done Burp testing for the API's for which you are making callouts.

There are certain points which are considered in security review:

  1. Injection (SQL, XML etc.)
  2. Cross Site Scripting (XSS)
  3. Broken Authentication and Session Management
  4. Insecure Direct Object References
  5. Cross Site Request Forgery (CSRF/XSRF)
  6. Security Misconfiguration
  7. Insecure Cryptographic Storage
  8. Failure to Restrict URL Access
  9. Insufficient Transport Layer Protection(no SSL enforcement, weak or null ciphers, session cookies without secure attribute)
  10. Unvalidated Redirects and Forwards

Beside this there are few points which salesforce include them in Black box testing:

As per my experience, salesforce checks if they are planning for the same functionality as we are providing and then they takes decision to pass the app or not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .