1

I created some Apex code in a Developer Org and I wanted to try to scan it before my security review so I submitted my username on Friday, here:

https://security.secure.force.com/security_tools_forcecom_scanner

I got a green confirmation bar saying they received my request but I didn't get any other email information confirming the scan started.

Now it's Tuesday, 4 days later, and I still haven't received any confirmation or results regarding my security scan. If I try to submit my username again, I get this message:

Due to high volume, users may only have one scan pending at any given time. Please wait for your current scan to finish. We apologize for any inconvenience.

Does it normally take this long? How can I get a status update of my scan?

2

Does it normally take this long?

It really does depend on volume. Especially shortly before and after a release, you can expect a wait time of up to a few weeks (the longest I've seen is about 14 calendar days).

How can I get a status update of my scan?

Try emailing sourcescanner@salesforce.com and asking them about it. Use the email associated with your user name that you submitted. Note that they can't tell you how long it'll be, but they might be able to give you a general indicator (e.g. there's 5,000 scans ahead of you, or something like that).

If you need constant or "real-time" on-demand scanning, you might consider buying in to the on-premise version (standard disclaimer: I am in no way affiliated with checkmarx and have no idea how the on-premise solution works). There may also be other projects available in the community if you take the time to do some research on your favorite search engine.

  • As of today, it's been 6 days and I still haven't received any updates. Since our company has a license of Checkmarx, is it possible to run the security scan ourselves? Is there a plugin or package we'd have to install first for that to work? – user1813867 Jul 8 '16 at 1:12
  • @user1813867 I know they have an on-demand and on-premise solution, but you'll need to contact them directly. I have no idea how to use it. – sfdcfox Jul 8 '16 at 15:52
0

My name is Gideon Kreiner and I help manage the Checkmarx / Salesforce relationship. You mention your company owns a Checkmarx license. Since Checkmarx supports many different languages, I'm happy to check and see if your organization subscribes to APEX/VisualForce. If the answer is yes, you most definitely can scan to prepare for your security review with immediate scan results.

Many Salesforce customers owning Checkmarx (especially those working in an Agile dev setting) use SDLC integration. This greatly speeds up the process of detection and remediation of security (and performance) issues. At a bare minimum, even without SDLC integration, owning the solution avoids the scan limitations of the Free Force.com security scanner. (We offer both on-premise and hosted solutions).

I can be reached at gideon.kreiner@checkmarx.com.

Sincerely,

Gideon Kreiner

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.