I've run the Force.com Source Scanner against my Managed Package and here are the summary results:

enter image description here

There are two areas FLS Update and FLS Create where I got 28, and 37 risks respectively...

I am wondering, do I have to put in code checks for each risk, or is it OK to add these as False Positivesdocument because the Permission Set included in the package is applied to all users to who this code?

1 Answer 1


You still need the FLS checks. The reason why is that administrators could choose to create a new Permission Set and allow users access to the code but not the fields for whatever reason, or even edit profiles and add code access directly, without field/object access. Never assume that your subscribers won't accidentally (or even intentionally) create security concerns by creating odd security setups.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .