Skip to main content

Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Stripe Embedded Form functionality in Salesforce LWC

We have developed an app that basically helps in accepting payments from Stripe. We have used Embedded Form in it where we have to pass this stripe's js cdn to use Stripe method pass public key & ...
Atlas Jay's user avatar
0 votes
0 answers
29 views

App Exchange Security review

I am having a big blocker question over App Exchange security review. While publishing our App to the AppExchange, and when we scheduled a security review ... Is security team of AppExchange will also ...
Pavan's user avatar
  • 3
1 vote
1 answer
68 views

Any problem passing a Salesforce security review if LWCs are using GraphQL?

GraphQL queries can be made from LWCs as below (from a GraphQL document Make Your Variables Reactive): @wire(graphql, { query: gql` query bigAccounts($minAmount: Currency) { uiapi {...
Keith C's user avatar
  • 136k
2 votes
1 answer
167 views

Salesforce code analyzer DFA

Im hitting a strange error when running the salesforce code analyzer DFA report - sf scanner run dfa --format csv --outfile CodeAnalyzerDFA.csv --target ./ --projectdir ./ --category Security Scanner ...
ravent's user avatar
  • 57
0 votes
1 answer
23 views

Exposing a custom API - Security Practices to consider suggestion

I'm constructing a prototype external web app form that will create a lead in Salesforce and making it available to the public. Web app will use the integration user from salesforce, and that user ...
mkjd99's user avatar
  • 3
0 votes
0 answers
34 views

Will pass access token via LWC flagged as Security Issue

while working on the Security Review Issue, I wanted to clarify our approach. We've built LWC components using our React code. In React, we call our backend API using fetch. To obtain the access token,...
vctqs1's user avatar
  • 95
1 vote
0 answers
37 views

ZAP Scan: Apex callout to our backend API

I am in the process of preparing materials for our security review submission. I have a case where our Apex code calls out to our backend API: Directly from Apex code Background job: Schedule, ...
vctqs1's user avatar
  • 95
0 votes
0 answers
38 views

Ensuring TLS Compatibility for Salesforce App Exchange Integrations

We're in the process of launching a free app for the Salesforce App Exchange. We've submitted our solution for security review, but unfortunately, it hasn't passed. Salesforce cited the need to ...
SF.com Learner's user avatar
1 vote
1 answer
108 views

Salesforce Code Analyzer Issues and False-positive documentation

I am preparing for the security review. I have resolved all issues from Checkmarx and I have resolved almost all the errors from the Salesforce Code Analyzer report. There are only 6 items left from ...
Nazar's user avatar
  • 45
0 votes
1 answer
56 views

Manage package security review issue: Insecure Storage of Sensitive Data

My application is currently undergoing security review and has been reported with the 'Insecure Storage of Sensitive Data' issue, cause I'm storing the auth credentials in custom Object to enable ...
Mostafa Ghonem's user avatar
-2 votes
1 answer
122 views

how to secure sfmc cloud pages from external scripts attack?

When it comes to the security of the cloupages. How can we prevent the external scripts running on the cloud pages and secure our cloud pages from RXSS attacks on the smart capture form fields on the ...
Adam Coder's user avatar
0 votes
0 answers
48 views

Getting "LimitReached" and "InternalExecutionError" errors in CodeAnalyzerDFA Report

I am getting "LimitReached" and "InternalExecutionError" in "CodeAnalyzerDFA Report" but didn't get how this error occurring and what is the solution for this. Can ...
Stack User's user avatar
0 votes
1 answer
66 views

Security review failed due to debug lines

So the salesforce security review of my mannaged package failed due to data in log lines they have stated the below: Issue Description Revealing information in debug statements can help reveal ...
ravent's user avatar
  • 57
0 votes
1 answer
89 views

Question about Endpoint scanning (ZAP) for security review

As part of the Salesforce security review they state: If your solution connects to any non-Salesforce domains, also run Chimera, ZAP, or Burp Suite on the external endpoints. Include reports from your ...
ravent's user avatar
  • 57
0 votes
2 answers
146 views

How to store secret API Key in the managed package?

My application is currently undergoing security review (AppExchange submitting) and has been reported with the 'Insecure Storage of Sensitive Data' issue related to the following line of code. private ...
Dinh Quang Khang's user avatar
0 votes
0 answers
23 views

If we remove the sample code and submit a new version for the security review, will there be an 'again payment required' for the submission

We recently submitted our package for the AppExchange security review, but unfortunately, it did not pass. The security review team indicated that, according to the Security Review Guidelines, 'the ...
Saravanan T's user avatar
0 votes
1 answer
47 views

CRUD/FLS in Apex Triggers

We are preparing a 2GP for security review and one of the common issues is CRUD/FLS. Our package notifies our server when opportunities or accounts change using triggers (webhook functionality). For ...
tubbytoad42's user avatar
1 vote
2 answers
128 views

How to pass Salesforce security review for 2nd generation managed package without using "with sharing" while defining class?

We have developed a 2nd generation managed package and submitted our package for security review. But after reviewed by Salesforce, they suggested us some suggestion. One of the suggestions received ...
Kapil Saini's user avatar
1 vote
1 answer
226 views

Does using the atob and btoa Javascript functions impact Salesforce Security Review?

We have a Second Generation Managed Package where we need to get the data from a JSON file. So using apex we are able access data of the JSON files having size less than 6 MB due to the heap size ...
S1th's user avatar
  • 143
1 vote
1 answer
57 views

Source Scanner Results:Query: Bulkify Apex Methods Using Collections In Methods

The Salsesforce Source Scanner if flagging my DatabaseFLS class for "Query: Bulkify Apex Methods Using Collections In Methods" with 5 issues, and provides the below: This best practice is ...
ravent's user avatar
  • 57
2 votes
1 answer
607 views

Do we have to pay $999 fee payment for any subsequent attempts of managed package security review on partner portal?

We submitted our Salesforce application (managed package) for Salesforce Security review, using the Partner Portal account(as we need to list the application on Salesforce AppExchange) and were ...
Kapil Saini's user avatar
0 votes
0 answers
42 views

Does using Function (an Alternative to eval function in js) will impact Salesforce AppExchange Security Review

In our Second Generation Managed Package, we are using Function() as an alternative to Eval Function as mentioned in this link to evaluate an expression in Aura Component. Does it have any impact in ...
S1th's user avatar
  • 143
0 votes
2 answers
98 views

Does Loading Static Resource Dynamically through URL pass the Salesforce AppExchange Security Review

We have created a Second Generation Managed Package and in it we need to load the static resource which is uploaded by the Subscriber (the one who installs the package). We have loaded the static ...
S1th's user avatar
  • 143
0 votes
1 answer
127 views

How to Fix Security Violation AvoidGlobalModifier in a Promoted 2GP Managed Package for the Security Review

I did wrong and I promoted a non-security-review-ready version in a managed package. I have a global identifier and if I try to create a new version without the it, it triggers a Global/WebService ...
Искрен Станиславов's user avatar
0 votes
1 answer
124 views

Do I need to check FLS for each field when creating a new object record in apex?

If I am creating a new Contact record in apex, will the following code be sufficient for FLS/CRUD requirements in a security review, or will I need to check .isCreateable() for each field individually ...
lhh13's user avatar
  • 41
2 votes
2 answers
250 views

Insecure Storage of Sensitive Data Vulnerability for a security review

We have received this issue in our security review "Insecure Storage of Sensitive Data Vulnerability ". I am making a call to external service to get a encrypted claim that i am using to ...
Manjot Singh's user avatar
  • 3,526
1 vote
1 answer
273 views

LWC: Click-jacking due to CSS Vulnerability

we received an issue in our salesforce security report "LWC: Click-jacking due to CSS Vulnerability". It list out CSS files where this issue is reported but no more info is provided for this....
Manjot Singh's user avatar
  • 3,526
1 vote
1 answer
327 views

Do I need to enforce security rules for SOQL in test methods?

I'm currently in the process of updating a managed package for security review. I've been adding the "WITH SECURITY_ENFORCED" statement to SOQL requests, however I've struggled to find any ...
lhh13's user avatar
  • 41
0 votes
1 answer
201 views

Upgrading a Second Generation Managed Package to next version

We have created a Second Generation Managed Package and published it in AppExchange and we need to release the next version with few changes in existing codes. These are the things which we don't ...
S1th's user avatar
  • 143
6 votes
2 answers
422 views

Zap scan commercial APIs used in AppExchange apps?

My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4). As someone who submitted ...
Robert Sösemann's user avatar
1 vote
1 answer
122 views

JS in Salesforce DOM security review failure

I have just been sent back the security review report for our ISV partner app and one of the errors is 'JS in Salesforce DOM'. The file they have referenced is a .weblink file, the code snippet they'...
lhh13's user avatar
  • 41
3 votes
1 answer
128 views

Salesforce managed package security review

We had submitted our managed package for security review and it had failed multiple times. In the latest failure report , below vulnerability is reported which does not have any public documentation. (...
Rohit's user avatar
  • 2,091
0 votes
1 answer
68 views

Would Changing the Installation key of the Second Generation Managed Package needs once again approval from Salesforce

We have published our Second Generation Managed Package in AppExchange Portal after approval from Salesforce. But we want to update the installation key of the Package. Would it needs approval once ...
S1th's user avatar
  • 143
1 vote
1 answer
576 views

AppExchange Security Review Requiring Fee Submission for FREE Listing Solution

Hope you are having a great day. We have developed an AppExchange solution to be listed. The solution's pricing model is set to free and the listing is submitted for approval. I have completed ...
Asadullah Shaikh's user avatar
0 votes
1 answer
157 views

Security Scanner finds XSS, JSENCODE incompatible with Radio field expecting Boolean value

ISSUE: XSS issue in the following code, value fields will not expect JSENCODE as it expects a Boolean. I have tried following options OPTIONS: value= Boolean('{!JSENCODE(IF(ques.Question__c,"true&...
Deeksha Gaur's user avatar
2 votes
1 answer
303 views

Lightning Message Channel deletion from 2GP or isExpose change to false

we failed security review of second-generation managed package because Lightning Message Channel (LMC) has isExposed=true. It should be false. The value of isExposed is not possible to change to false,...
rstrader's user avatar
4 votes
1 answer
207 views

Is the User Mode approach to object and field security acceptable in a security review?

This Enforce User Mode for Database Operations looks by far the cleanest approach to implement the object and field-level security that is required to pass a Salesforce AppExchange Security Review. (...
Keith C's user avatar
  • 136k
2 votes
0 answers
95 views

What differs between Checkmarx in Partner or Customer Security Portal?

I want to submit a package for security review, and Checkmarx in the Partner Security Portal has been unavailable for some time. At this point, I can either keep trying to resolve why it doesn't work ...
Manuel Moya's user avatar
0 votes
2 answers
155 views

New Partner Console: Update Sec Review documents for new version

I recently published a brand new Managed Package to the AppExchange. I passed Security Review as well. Now a few weeks later, I made some enhancements to my app, which also changed the documents that ...
Robert Sösemann's user avatar
0 votes
1 answer
45 views

Is request invocation from frontend javascript is secure and safe? What is the limit for file size when uploading files using Visualforce Javascript?

On one legacy project the following pattern was implemented. Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with ...
Patlatus's user avatar
  • 17.2k
7 votes
3 answers
1k views

With USER_MODE - do we still need SOQL and DML libs?

As the Security model of Apex was leaky in the past, everybody who took - or as AppExchange Partners had to take - Security seriously was building or using libraries to enforce CRUD/FLS rules. The ...
Robert Sösemann's user avatar
3 votes
1 answer
178 views

Security Review Test Environment - how many users for Salesforce?

Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review. I tried to find that rule in an official ...
Robert Sösemann's user avatar
0 votes
1 answer
234 views

When is the External Service Scan required in Salesforce Security Review?

I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional ...
Manuel Moya's user avatar
0 votes
1 answer
56 views

Self certify that the package is lightning ready

How do I certify that my package is Lightning ready? Is that something that we have to raise the case with the community? In the checklist, it shows that I have to "Self-certify listing as ...
Rahul Allada's user avatar
1 vote
1 answer
121 views

Salesforce package version creation after resolving the errors

We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the ...
Rahul Allada's user avatar
1 vote
0 answers
75 views

Checkmarx reporting wrong function name?

I just ran a Checkmarx scan today. It reported the following Apex Serious Security Risk: You can see the report is making a reference to isCreatable(). However, the name of the method in my Apex code ...
dev4life's user avatar
  • 532
0 votes
0 answers
54 views

'Select Listing Name to Scan' is empty in the Partner Security Portal

As mentioned by @phil in Sending review to the checkmarx where multiple developments are included I have gone to partner security portal. Though the packages are being displayed in the partner ...
Rahul Allada's user avatar
1 vote
1 answer
204 views

Sending review to the checkmarx where multiple developments are included

I have a org that is connected to the partner community. In this org, there are managed packages, unmanaged packages, and various other developments that includes code that is not required for the ...
Rahul Allada's user avatar
0 votes
1 answer
147 views

How to scan the Second Generation managed package code on Checkmarx Scanner from Partner Security Portal

I have created a second generation managed package using the dev hub org and namespace org and I have connected the dev hub org in the organizations subtab in publishing tab. But when I tried to login ...
S1th's user avatar
  • 143
1 vote
0 answers
202 views

What does the Dereferenced Field vulnerability in Security Review scan means?

I've received a vulnerability from Checkmarx scan that is labelled as Dereferenced Field vulnerability. The scan report message reads like this: A possible dereference exist in method uploadDocument. ...
VarunC's user avatar
  • 6,000

1
2 3 4 5
8