5

Is it possible to run Source Code Scanner / Checkmarx against a Scratch Org?

When I click the Login link on this page:

https://security.secure.force.com/sourcescanner/

It redirects me to:

https://login.salesforce.com/services/auth/sso/00D30000000JsbiEAC/SourceScanner?site=https://security.secure.force.com/sourcescanner

And my Scratch Org login details don't work...

Is it possible to run Source Code Scanner / Checkmarx against a Scratch Org?

12
  • 3
    Pretty sure it is not possible. The scanner now explicitly lists orgs it can be used with, and I think they have to be developer edition.
    – Phil W
    Commented Jan 2, 2021 at 21:56
  • 2
    Or in IntelliJ IDEA. This is what we do during early prep for security review.
    – Phil W
    Commented Jan 2, 2021 at 23:21
  • 3
    Apex PMD is recommended for pre-Security Review scans, but the actual Security Review needs a Checkmarx scan. I've not been in the ISV game since 2014, so you may want to contact Partner Support for the correct process for 2GMP. I do think it'd be worth keeping this question with an answer once you find out more information.
    – sfdcfox
    Commented Jan 2, 2021 at 23:49
  • 2
    AFAIK no. FYI, this way of running scans forcedotcom.github.io/sfdx-scanner that is likely to flag some of the same issues that Checkmarx flags. Uses PMD and maintained by Salesforce.
    – Keith C
    Commented Jan 3, 2021 at 8:50
  • 2
    Set of comments here looks like more of an blog article about how to prepare for a security review
    – kurunve
    Commented Jan 3, 2021 at 9:49

1 Answer 1

1

If you run your scan through the partner security portal, on https://security.secure.force.com/sourcescanner/PackageScannerMain, then you will find that you select package versions, not orgs, for the scan to run against.

4
  • Any ideas why the Select Package Version ID to scan: drop-down list is empty?
    – Robs
    Commented Jan 4, 2021 at 12:22
  • Is the package related to a listing? (Even a private one.)
    – Phil W
    Commented Jan 4, 2021 at 12:39
  • I've added it to a listing, how long does it take to appear?
    – Robs
    Commented Jan 4, 2021 at 20:49
  • I can't say as I didn't try straight away. Is it working after the wait so far?
    – Phil W
    Commented Jan 5, 2021 at 7:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .