Questions tagged [chimera-security-scanner]

Chimera is a cloud-based security scanning service that combines several open-source security scanning tools into one service. Chimera is powered by and scans from the Heroku cloud platform. Custom-built code then combines and analyzes the results from all scanning tools used and provides a single, actionable security report to you

Filter by
Sorted by
Tagged with
6 votes
2 answers
391 views

Zap scan commercial APIs used in AppExchange apps?

My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4). As someone who submitted ...
Robert Sösemann's user avatar
1 vote
1 answer
162 views

Security Review: Cloud Service uses and stores OAuth tokens

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database. As this service wasn't on the AppExchange my customer did not ...
Robert Sösemann's user avatar
5 votes
4 answers
959 views

How different is Initial Security Review from Resubmission

An ISV customer of mine has a Managed Package in the AppExchange for many years now. He recently was asked to resubmit for Security Review and is now wondering what to expect and how to best plan and ...
Robert Sösemann's user avatar
8 votes
2 answers
5k views

How to OWASP ZAP scan external REST API using OAuth2

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require ...
Robert Sösemann's user avatar
3 votes
1 answer
441 views

Endless loop of Chimera scans with failure

Today I started a Chimera scan from https://security.secure.force.com/sourcescanner/chimera__chimera_portal to scan an external API we use in an ISV app which is going into Security Review soon. ...
Robert Sösemann's user avatar
-1 votes
1 answer
57 views

Publish App exchange application with Scanning [duplicate]

I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use SOURCE SCANNER for Apex class and visual force ...
Divya's user avatar
  • 1
6 votes
1 answer
2k views

security scan for web application using ZAP, Chimera, or Burp

In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap. If your app ...
SFDC's user avatar
  • 461
2 votes
1 answer
128 views

Security Review on links to webpages from external application

I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame. My external application contains links to external websites ...
Hugo's user avatar
  • 91
4 votes
0 answers
196 views

How to generate scan results for the external endpoints to pass salesforce security review?

I have build Salesforce appexchange app and i have used amazon s3 server api to store files in amazon server. I have generated the report for security and quality check but i dont know how to generate ...
Sagar Thoriya's user avatar
1 vote
0 answers
204 views

security review: chimera report - Cross-Domain JavaScript Source File Inclusion

I'm preparing for my first security review for an application which has an external web app. I'm looking at the Chimera report and I'm seeing the error: Cross-Domain JavaScript Source File Inclusion. ...
shartshooter's user avatar
2 votes
0 answers
395 views

Chimera Token not getting detected in apache

I have uploaded the token, and it is accessible via http://ksinkar.edubrite.us/ChimeraToken.txt But somehow Chimera scanner is not finding it, can you please assist whats wrong here? This is the ...
Ashish Gaonker's user avatar
7 votes
2 answers
2k views

Where we have to upload Chimera abuse prevention token and what is Target URL in the New Scan page

I am trying to scan my application in Chimera portal, I have logged into the portal and downloaded the abuse prevention token. Now I am not understanding where to upload it. In portal it says "You ...
Pradeep Chary's user avatar
2 votes
1 answer
922 views

Chimera Security Review not finding anti-abuse token for Heroku NodeJs application

I'm trying to review a Nodejs web application as part of an SF app exchange registration - using Chimera. First hurdle is the review keeps coming back unable to verify it's my app. I've uploaded ...
Gilbert Grant's user avatar
3 votes
1 answer
204 views

Security Scan for remote site

Can you please help me running scan for a remote site setting. SFDC asked for chimera report for remote Site setting. eg. I have a remote site setting with URL as: https://abc.abc.com and which gets ...
Rahul's user avatar
  • 91
4 votes
2 answers
1k views

Error logging in to Chimera and got error. Please suggest

When we tried to logging in Chimera, but got the following error. We want to scan our code before security and technical review process. Please suggest. Problem Logging In We can’t log you in ...
Bforce's user avatar
  • 6,828
4 votes
1 answer
910 views

Chimera Scanner testing server with no login credentials

I've been looking into the Chimera Security Scanner and it mentions that you have to provide test credentials and the URL of your service and, Chimera will handle the rest. The only issue that we ...
Lucas Anderson's user avatar