Just looking for the top few things to watch out for. Can anyone recommend common mistakes or areas of concern?


Quick search on google:


Q: What are common reasons why I would not pass the security review

A: The following is a list of the top reasons why offerings are not approved (Mirrors the OWASP Top 10):

  • Injection (SQL, XML etc.)
  • Cross Site Scripting (XSS)
  • Broken Authentication and Session Management
  • Insecure Direct Object References
  • Cross Site Request Forgery (CSRF/XSRF)
  • Security Misconfiguration
  • Insecure Cryptographic Storage
  • Failure to Restrict URL Access
  • Insufficient Transport Layer Protection(no SSL enforcement, weak or null ciphers, session cookies without secure attribute
  • Unvalidated Redirects and Forwards
  • 2
    What I was going to say, but with more words. Thanks for keeping it simple.
    – sfdcfox
    Jun 29 '16 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.