1

I'm creating a package in a Developer Edition and there's a couple reasons why I want to keep all my components (apex code, visualforce pages, etc) in a package.

  1. It lets me subscribe to the components very easily in the eclipse IDE
  2. It lets me upload the unmanaged package

However one of the requirements for the security review is that you scan your components with the Force.com security scanner which doesn't scan code contained in packages. Do I need to create a completely separate developer Org which has the components in a non-packaged context just so I can scan it?

Is there another way to do this?

Improve this question
2

It doesn't scan code in installed packages. It scans just the code that is native to the org. There's no problem with just pointing the scanner at your existing org.

Improve this answer
  • So if I Create a package in my DE, and add all my components to that package, then there's no problem? The code will still get scanned? – user1813867 Jul 20 '16 at 22:27
  • @user1813867 exactly. All of the code outside installed packages will be scanned, regardless if it's inside a package or not. – sfdcfox Jul 20 '16 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.