6

I have developed an app in my Dev org and am in the process of publishing it. Prior to the publishing steps, I wanted to perform a security scan on my entire code and I happen to land in the following web link: http://security.force.com/security/tools/forcecom/scannerhelp and I see a point in here mentioned as Each user must comply with the throttling rules: no more than 3 scans per security review and no more than 30,000 lines of code scanned per month. I was wondering that this intends to say that a user could only perform security scan for only 3 times and the lines of codes during these 3 chances must not cross more than 30,000.

Because, I already submitted once and the number of lines shown during that time were 31,415. So, I am in kind of confusion state whether to go ahead and submit for the 2nd time or not.

Please correct me if I am wrong.

  • The 30,000 lines pre month appears to be a typo in the documentation. Else where it mentions 500,000 lines per run. I've pinged the SalesforceDocs team to see if they can clarify. Also, you used to be able to get a free checkmarx plugin for Eclipse, but I don't see that option any more. – Daniel Ballinger Dec 9 '14 at 22:32
4

Here is the "Official" answer:

The 500,000 line of code limit is a limit that Salesforce imposes on the size of a single scan. This is because 1) larger scans will probably time out on most queries anyway, so you aren't going to get good results for huge scans, and 2) scanning performance is roughly (given my experience) quadratic in lines of code, so we need to prevent one scan from taking up the resources that could have been used to scan many other projects.

The 30,000 lines of code per month restriction is a restriction from Checkmarx, not from Salesforce. We currently do not enforce this programmatically, but soon it will be enforced.

The above restriction does not apply to partners scanning for the security review, who are given 3 free scans per review.

Because the bulk of our scanner usage consists of partners scanning one or two times for the security review, this should be a non-issue for most people. For the same reason, there are very few apps larger than 500,000 lines of code, so this is again a non-issue for most users.

Nevertheless we do have a minority of high volume users who try to integrate the scanner into their development process, which is not a supported use case. In this case, they should purchase their own license from Checkmarx, we have already enforced a number of different throttling checks to try to limit this type of use.

Finally, there are some users who are scanning their own code and are maintaining large organizations. These users should also purchase their own license from Checkmarx.

If you have additional questions, please send them to sourcescanner@salesforce.com

  • Thanks Robert Sussland for the brief explanation. And I did submit my code using code scanner and also in the final steps of submitting the application as well. – Sapthagiri Feb 25 '15 at 7:48
  • If the issue was the 500,000 line limit, then when you submit for security review, we will count the lines and then auto-pass the scanner requirement without scanning the code. If you submit via the portal, we will send back the code too large email. In both cases, you will not be blocked from proceeding with the security review. – Robert Sussland Feb 27 '15 at 0:02
2

The "official" words from the Salesforce Security twitter account are:

"Checkmarx allows us to give all customers 30k lines for free."
"Limits for partners are slightly different. The limit is 30k per month."

Your first scan going past that limit is a bit of an oddity. There shouldn't be any harm in trying again.

If you do hit the limit try applying for the free Eclipse plugin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.