Checkmarx results for appExchange entries

Question

Our company's internal Information Security folks are used to using Veracode to scan web & app code.

I understand appExchange entries are scanned via SFDC / Checkmarx.

My question is: Is there a way for a customer (us) to view the scan results for available appExchange entries?

Or is the only information available: "pass mean pass"? (And presume if it had failed, it wouldn't be listed)?

If not the results, is the battery of questions or tests performed available? And does pass mean 100% passed?

Is the latest date of scan visible anywhere?

Thank you,

Bruce

Ashwani · Accepted Answer · 2015-09-15 12:49:43Z

My question is: Is there a way for a customer (us) to view the scan results for available appExchange entries?

Answer: NO, but you can provide the scan doc in as resource or link.

Or is the only information available: "pass mean pass"? (And presume if it had failed, it wouldn't be listed)?

Answer: Pass means pass.

If not the results, is the battery of questions or tests performed available? And does pass mean 100% passed?

Answer: Pass means you have cleared the security review and application is ready to be listed on Appexchange publicly.

Is the latest date of scan visible anywhere?

Answer: No, only you know it (internally)

1 Answer 1