We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security review ?

Some issues we got were VfUnescapeEl, ApexCRUDViolation, ApexSuggestUsingNamedCred

1 Answer 1


Salesforce Security review team expect to see a Checkmarx report, not a PMD report, as part of your submission.

Both Checkmarx and PMD are there to help you identify possible security issues that you should pay attention to. As such you should take action for each item flagged by PMD but more importantly, from the submission perspective, each issue flagged by Checkmarx.

Both tools have a tenancy to report so-called False Positives. For example, you may perform your CRUD/FLS checks in a separate method to a query or DML and both tools are likely to flag the query or DML as involving objects or fields that the user cannot access (of course there are newer Apex features like stripInaccessible etc. that would prevent such reporting).

Anyway, this is where Salesforce would expect you to include a False Positive report with the submission - a document listing all the places where Checkmarx incorrectly flags issues.

We took a slightly different approach. We created a generic document that explained how we added comments on the end of each line of code where Checkmarx flagged an issue that was a False Positive explaining why it is a False Positive. That way the Checkmarx report itself becomes the False Positives document.

  • thanks for your reponse, @Phil W instead of checkmarx, if we use chimera source scanner , is it okay ? Feb 8, 2022 at 7:07
  • These scanners are for different purposes. Checkmarx is required for your on-platform "app" (what you will package). Chimera is for scanning off-platform sites your app uses.
    – Phil W
    Feb 8, 2022 at 7:22
  • Got it, thanks for the info Feb 8, 2022 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .