I've reached the point where I'd like to scan my Apex code, but up until now it's all been written in a Developer Org.

The scanner asks for a username only - how can I specify that the code I want is in a developer Org?

2 Answers 2


The question here is about running the Security Scanner (NOT on how to conduct a Security Review for AppExchange apps). To do so, all you need to ensure is that your code resides in a loose form (not packaged) in the developer org that you are submitting.

Here's the official documentation

'Only unpackaged code is scanned. Source code within managed or unmanaged packages is not scanned to avoid inadvertently scanning code unrelated to your application.'

This is actually mis-interpreted by most people and it often leads to scanner email stating 'No Code'. This is explained in the FAQ on the quoted link.

First, make sure that there is loose (unpackaged) code to scan: apex classes, triggers, visualforce pages. The scanner does not download any packaged code.

Your username is unique so it will be able to detect that it's from a developer org.


Up till now, i have got done some security reviews, out of which all of them were developed in developer orgs.

As per Salesforce, Package should be developed in developer org and its must if its managed package. (Basically, No one can package package in Sandbox as it gets refreshed.)

Check description under title"Developer Edition is ideal if" https://developer.salesforce.com/page/An_Introduction_to_Environments

Any how, The username you are going to supply will be unique across Saleforce so they will know which type of org is this so you don't need to explicitly mention its type.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .