I am trying to write an application in SF Lightning that uses angular (not angularjs, angular, version 7 if it matters) as the front end. To handle this (since it truly is a separate app that is hosted and backed by SF for data provisioning and login provisioning) we are putting it in a lightning container.

I know that quite a lot of custom development goes on in Angular in SF, but my concern is getting past the security review to put it on the App exchange. Has this been done before? Is it common?

I think we can certainly meet the necessary security guidelines in our application, however, we do use a few external components like the froala html editor. Can someone with some experience of this tell me what challenges I am likely to find in the security review with these external modules?

My fear is that I commit a lot of effort and energy into developing an application in this format and, after all the work is sunk cost, I get to the security review and encounter completely unsolvable problems. So anything that you can offer to help me understand this would be great.

2 Answers 2


Here are the below things i would do to mitigate any risks

  • Open an office hour with salesforce security team and walk down the design with them to see how they feel it. If you are partner then you can book here

Using lightning container essentially you are i-framing or sandboxing your front end code which adds some security.

The general security guidelines for lightning container is documented here

In short you will need to put all your Javascript code in static resource and also make sure it validates using namespace.

Also with security team you will need to share whole source code and not just minified version of it.

Also I suggest using tools like Snyk and RetireJs to find any security vulnerabilities.


This is currently being done with the field service lightning app. If you install field service lightning you can see angular modules within the included static resources if you download them. Field Service Lightning is still not AppExchange ready but likely will be in the future versions.

So yes it can be done but it will still require you to follow the security guidelines.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .