Questions tagged [chimera-security-scanner]

Chimera is a cloud-based security scanning service that combines several open-source security scanning tools into one service. Chimera is powered by and scans from the Heroku cloud platform. Custom-built code then combines and analyzes the results from all scanning tools used and provides a single, actionable security report to you

Filter by
Sorted by
Tagged with
1 vote
1 answer
114 views

Security Review: Cloud Service uses and stores OAuth tokens

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database. As this service wasn't on the AppExchange my customer did not ...
5 votes
4 answers
721 views

How different is Initial Security Review from Resubmission

An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
7 votes
2 answers
4k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
3 votes
1 answer
298 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
-1 votes
1 answer
46 views

Publish App exchange application with Scanning [duplicate]

I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use SOURCE SCANNER for Apex class and visual force ...
  • 1
6 votes
1 answer
2k views

security scan for web application using ZAP, Chimera, or Burp

In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap. If your app ...
  • 551
2 votes
1 answer
96 views

Security Review on links to webpages from external application

I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame. My external application contains links to external websites ...
  • 91
3 votes
0 answers
158 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
1 vote
0 answers
163 views

security review: chimera report - Cross-Domain JavaScript Source File Inclusion

I'm preparing for my first security review for an application which has an external web app. I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
2 votes
0 answers
319 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
7 votes
2 answers
1k views

Where we have to upload Chimera abuse prevention token and what is Target URL in the New Scan page

I am trying to scan my application in Chimera portal, I have logged into the portal and downloaded the abuse prevention token. Now I am not understanding where to upload it. In portal it says "You ...
2 votes
1 answer
719 views

Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
3 votes
1 answer
180 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
  • 91
4 votes
2 answers
990 views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
  • 6,676
4 votes
1 answer
733 views

Chimera Scanner testing server with no login credentials

I've been looking into the Chimera Security Scanner and it mentions that you have to provide test credentials and the URL of your service and, Chimera will handle the rest. The only issue that we ...