0

I have developed a 2nd generation Managed package for Salesforce App Exchange. I want to submit my Scratch Org Code for Salesforce Checkmarx security check.

Can any one suggest how to get my code security check reviewed?

OR

For Partner Business Org, Which type of org we need to connect for Salesforce Checkmarx review -

  1. Scratch Org (Where development is done)
  2. Dev Hub Org
  3. Git Environment (Where code is present)

Thanks in advance.

Improve this question
9
  • Since you need the org to be available for more than 30 days, you cannot use a scratch org. You need to set up a dev org instead, where you should install the package (not deploy the code). Have you been through the trailhead module and read the ISVForce docs?
    – Phil W
    Commented Jun 9, 2023 at 10:12
  • For partners, using the partner security scanner portal, you get to select the package and version to submit to Checkmarx without using any org at all.
    – Phil W
    Commented Jun 9, 2023 at 10:13
  • @PhilW , currently we haven't created a released version of the managed package. Currently we are testing only on the Beta package and it is stable now. Now as a next step we need to generate a CheckMarx report which needs to be done by submitting the org with Checkmarx for CRUD/FLS/Quality(for listing this app on appexchange). It was easy in first generation but in Second Generation how can we submit for checkmarx review.
    – Parvez Alam
    Commented Jun 9, 2023 at 14:20
  • @PhilW Should we create the first release version of the managed package and then connect the Dev Hub Org with the Partner Account and then in the partner account we will see an option to submit the dev Hub account/selected managed package(released version) for checkmarx review or is there a way in which we can submit the the Beta package for checkmarx review also from the Partner Account as our limit for 360000 lines is already exhausted. Please share your thoughts.
    – Parvez Alam
    Commented Jun 9, 2023 at 14:21
  • As a partner you must use your PBO as the Dev Hub; this was mandated by Salesforce (we didn't want to do this, but that was the only choice if we wanted the high scratch org management limits). That means the package is correctly associated with your partner account. Whether you need to create a managed release before you can Checkmarx for the first time, I don't know - we had already created managed releases before we went to security review. You can definitely scan beta releases.
    – Phil W
    Commented Jun 9, 2023 at 16:05

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .