We are trying to host our application in Appexchange. So before submitting we did scan code review in security portal of salesforce and got some errors.

We are trying to fix those issues in our local and trying to make sure all the issues are fixed before submitting the scan again. So for that in our local machine we installed Checkmarx VSCode plugin.

When we try to setup the plugin its asking for CxSAST URL, which means

Is there any cloud CxSAST URL which is for free is there? or have to purchase the package and install it in our machine. Tried to lot to get those URL but not able to.

We used SFDX Scanner but not getting those results as we got in Checkmarx

  • You have to pay for Checkmarx if you don't use the partner security portal to execute it.
    – Phil W
    May 3, 2021 at 7:28

1 Answer 1


There is not a free cloud CxSAST instance available as Checkmarx is a paid product, so ask your employer to look into purchasing an instance or, if you are the employer, you can evaluate an instance.

However if you are a partner submitting for the appexchange security review, you can use the cloud service. Salesforce has purchased a license which grants you one free scan for each package version id, when scans are on a per-package basis. https://security.secure.force.com/sourcescanner/

There is also a customer portal which has line of code restrictions, 30K/month with a 12 month lookback, or (equivalently) 360K/year. https://security.secure.force.com/security/tools/forcecom/scanner

Unfortunately having the partner portal expose an API that would allow you to hook your IDE into the partner portal is not on the table, as you need to login with your partner account, we do not expose the checkmarx instances directly to the public (just imagine the load balancing or security concerns with giving every partner an account), there is custom pre and post processing happening between the job request and the result (you may have noticed the scan result html files you retrieve from the portal look nothing like the checkmarx reports) and there would be no way to associate the code you are scanning to a package version in order to enforce licensing restrictions. For the customer scanner, the line of code restrictions would not allow the plugin to be usable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .