I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review.

To achieve this, our logging system creates records for a custom log object. For example, a record might contain the following information:


Message: Invalid API token.

My question is: if these log object records do not contain sensitive data (i.e. Account information, credentials, etc.) does this logging architecture pose any sort of vulnerability that would prevent the application from passing the security review?

  • 1
    A typical problem that can arise is that an effective logging algorithm needs to ignore security/sharing (imagine if you couldn't log a log unless the user had permission to view/edit the logs). This will raise some red flags during the review process, but as long as you can defend the need to log, and prove that it does not leak sensitive information, it should likely pass review. However, you should ask security-related questions like this directly to the review team, because they can give you better guidance. – sfdcfox Feb 13 '18 at 17:10
  • 1
    @sfdcfox Isn't that a big advantage of Platform Events? – Adrian Larson Feb 13 '18 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.