Apex Source Scanner flag CRUD/ FLS as security risk for no reason

Question

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several security risks flag although CRUD and FLS are enforced as required

//..some code

fflib_SecurityUtils.checkInsert(    //Throw an exception if CRUD/ FLS is not valid
                customObject__c.SObjectType,   // check sObject.isCreatable()
                new List<Schema.SObjectField>{
                        customObject__c.Age, //check customObject__c.Age.isCreatable()
                        customObject__c.Address }); //check customObject__c.Address.isCreatable()

customObject__c cust = new customObject__c(

                Age= 10,
                Address = 'Paris, France'
);

            insert cust;

SOURCE SCANNER SECURITY RISK FLAG

Do you think i should consider it as False positive and document it for the security review team or should i check any further?

Thank you

Answer 1

To help others who end up here, my response as an answer:

From what you posted, looks like a false positive - so I would document it in review.

Here is a link to a recent update from the SR team about how to document your false positives

As much as anything, the team is looking for you to show awareness of implementing security on the platform, so if you can show you are not exposing data etc, they should be ok with it

e.g.

FLS Create result path 1: Object: status__c in file: /classes/MyRequestData.cls

Response: This is checked via a general security/permissions check at start of class using fflib_SecurityUtils.checkInsert

If no access, permission check will throw exception, and code will no longer execute