1

I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the package that has to be sent to the review purpose.

Is there any way through which I can omit the other development code that is not used in building the package or will the checkmarx tool take all of the code that is unpackaged?

Improve this question
5
  • Are you an ISV? Are you submitting through the partner security portal? If so, you select the package and version to scan, so that is the package's code rather than anything else. Yes, you also have to provide access to a functional org for manual testing by the Salesforce Security team, so be careful to set up an appropriate org.
    – Phil W
    Commented Mar 13, 2023 at 8:26
  • Thanks for the reply, @phil. Yes we are an ISV. At present, I am submitting my credentials through security.secure.force.com/security/tools/forcecom/scanner. And this is taking the code that is only unpackaged. (And that is why this question). So, If I submit through partner security portal, can I directly specify the package that I wish to verify?
    – Rahul Allada
    Commented Mar 13, 2023 at 8:36
  • You provide credentials for an org used for manual testing but for Checkmarx you are using the wrong page. Notice the third paragraph on that page which says "Partners are encouraged to use the Partner Security Portal, which offers advanced functionality specifically for partners".
    – Phil W
    Commented Mar 13, 2023 at 8:50
  • Thanks, @phil. Can I use code scanner how many ever times I need?
    – Rahul Allada
    Commented Mar 13, 2023 at 8:54
  • No. 3 times per release version. However, you can create a beta release and run the scanner against that three times IIRC.
    – Phil W
    Commented Mar 13, 2023 at 8:57

1 Answer 1

Reset to default
1

It is important to use the correct portal, the Partner Security Portal, to run Checkmarx against managed packages.

You must first create a beta or managed release version for your package. You'll then see this listed on the portal when you navigate to the "Source Scanner".

There are some strict limits on the number of times you an run Checkmarx.

You will find the process documented in the ISVforce Guide. Search for "checkmarx" as needed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .