Questions tagged [chimera-security-scanner]
Chimera is a cloud-based security scanning service that combines several open-source security scanning tools into one service. Chimera is powered by and scans from the Heroku cloud platform. Custom-built code then combines and analyzes the results from all scanning tools used and provides a single, actionable security report to you
16
questions
6
votes
2
answers
362
views
Zap scan commercial APIs used in AppExchange apps?
My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4).
As someone who submitted ...
- 37.3k
1
vote
1
answer
156
views
Security Review: Cloud Service uses and stores OAuth tokens
My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.
As this service wasn't on the AppExchange my customer did not ...
- 37.3k
5
votes
4
answers
915
views
How different is Initial Security Review from Resubmission
An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
- 37.3k
8
votes
2
answers
5k
views
How to OWASP ZAP scan external REST API using OAuth2
I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
- 37.3k
3
votes
1
answer
412
views
Endless loop of Chimera scans with failure
Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon.
...
- 37.3k
-1
votes
1
answer
53
views
Publish App exchange application with Scanning [duplicate]
I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use
SOURCE SCANNER for Apex class and visual force ...
- 1
6
votes
1
answer
2k
views
security scan for web application using ZAP, Chimera, or Burp
In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap.
If your app ...
- 461
2
votes
1
answer
118
views
Security Review on links to webpages from external application
I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame.
My external application contains links to external websites ...
- 91
4
votes
0
answers
190
views
How to generate scan results for the external endpoints to pass salesforce security review?
I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
- 928
1
vote
0
answers
197
views
security review: chimera report - Cross-Domain JavaScript Source File Inclusion
I'm preparing for my first security review for an application which has an external web app.
I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
- 337
2
votes
0
answers
378
views
Chimera Token not getting detected in apache
I have uploaded the token, and it is accessible via
http://ksinkar.edubrite.us/ChimeraToken.txt
But somehow Chimera scanner is not finding it, can you please assist whats wrong here?
This is the ...
- 193
7
votes
2
answers
2k
views
Where we have to upload Chimera abuse prevention token and what is Target URL in the New Scan page
I am trying to scan my application in Chimera portal, I have logged into the portal and downloaded the abuse prevention token. Now I am not understanding where to upload it. In portal it says "You ...
- 334
2
votes
1
answer
884
views
Chimera Security Review not finding anti-abuse token for Heroku NodeJs application
I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
3
votes
1
answer
200
views
Security Scan for remote site
Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting.
eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
- 91
4
votes
2
answers
1k
views
Error logging in to Chimera and got error. Please suggest
When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest.
Problem Logging In
We can’t log you in ...
- 6,786
4
votes
1
answer
881
views
Chimera Scanner testing server with no login credentials
I've been looking into the Chimera Security Scanner and it mentions that you have to provide test credentials and the URL of your service and, Chimera will handle the rest.
The only issue that we ...
- 173