What's the deal with Deno? We talk with a major contributor to find out. Listen now.

Questions tagged [security-review]

All applications enrolled in the ISVForce or Force.com Embedded Partner Programs must go through a mandatory periodic security review. The Security Review has been developed to assess the security posture of partner offerings, to ensure that applications published on the AppExchange follow industry best practices for security, and to promote trust.

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

Security Review expectations on Logout Configuration

Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to ...
1
vote
1answer
44 views

Error when installing a managed Beta package on a DE Sandbox

The description of a managed beta package reads: "use to test and validate this package internally and with selected customers before release. Note: this type of package can only be installed in ...
1
vote
0answers
61 views

Security Review without AppExchange listing

We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce. A potential new customer now requires our ...
1
vote
2answers
546 views

Alternatives for innerHTML in jQuery

This might seem a question not related to this forum. But, according to Salesforce Security reviews, we are not supposed to use innerHTML in our code. Since, this could cause Cross-Site-Scripting(...
1
vote
1answer
206 views

How to resolve Bulkify apex methods using collections in methods (Chckmarx issue)? [closed]

I have submitted my code for security review and got a few warnings for the Bulkify Apex Methods Using Collections In Methods. I have read the code best practices and also some stack exchange posts ...
1
vote
1answer
53 views

Salesforce Security - Identifying vulnerabilities

I have completed a review of the following aspects of our organization a) Authentication b) Verifying profile based permissions are inline c) IP restrictions d) Timeout on unattended sessions e) ...
1
vote
3answers
55 views

Not able to update code in packaging code

In a developer org, I created a managed package and released it for security review. The security review was stopped due to few reasons. However, I need to update the package with the new version of ...
1
vote
1answer
35 views

Salesforce: Security Review- Second Organization

A quick question on the security review process, I have everything set up and running on the original developer organization, the publisher portion of it is good. I have no issues outstanding with the ...
1
vote
0answers
43 views

Custom javascript is not allowed to run on Salesforce DOM [duplicate]

Recently i have created an app which uses custom JavaScript in sidebar home page component using custom links, The app works perfectly and i also uploaded it to appexchange as managed released package ...
1
vote
1answer
543 views

Tooling API and Scheduled Batch Apex - How to access

Without storing a users credentials to salesforce how can one access the tooling API during a daily scheduled batch? Currently we are storing the users username and password in encrypted fields but ...
1
vote
1answer
360 views

Why is the Salesforce security scan saying I don't check isCreateable()?

I am baffled by the Salesforce automated security scan. I just ran it and it says: This query looks for sObject Create operations that are performed without checking for isCreatable(). This may be a ...
0
votes
1answer
221 views

CRUD and FLS checks for Batch class , Are they mandatory from security review prospective?

I am working on product and we have lot of Apex Batch Classes developed, I submitted my org code for Checkmarx review and I got lot of security review changes regarding CRUD and FLS check. However I ...
0
votes
1answer
15 views

Change aesthetic things in an app package

Suppose I have an app ready to deploy to the AppExchange. It just passed the Security Review, but I see that there are minor changes like a field's, object's or tab's label/name. Such change could be ...
0
votes
1answer
635 views

Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile [closed]

This update is getting enforce in my org on the 5th of April 202o, since some of the updates in my org are having deactivation options after enforcement and some of them are not having. so I want to ...
0
votes
1answer
76 views

Managed package and security review

We have developed a solution that we want to distribute as ISV on AppExchange. What happens if we have people install those packages while they are in review? Do customers need to reinstall our ...
0
votes
2answers
414 views

Locker Service and 3rd party library, how to pass Security review?

Is it a way to use 3rd party library/framework like Vue/Angular and bypass security review by Salesforce. Because only option to use those kind of library seems possible with version 39.0 which is ...
0
votes
2answers
63 views

What should I do to resolve salesforce security review?

I had run a security review for my apex code. It returned a number of FLS update error in the result. I have changed/implemented code (see below the code snippet) but the error is still there. Please ...
0
votes
1answer
166 views

Iframe in manage pacakge

I want to create an appexchange app. In that app, external site page(other system's page) will be shown under salesforce tab. To show external site page in visualforce page/lightning component, i will ...
0
votes
3answers
65 views

Configure settings for managed package that integrates with external web service?

I am sure there is a best-practice way to handle this, but I don't know what it is... The situation is that I am about to submit my Salesforce package for security review. The package works by ...
0
votes
2answers
667 views

CRUD/FLS Enforcement in Apex code

I was under the impression that if you declared your classes as: global with sharing class HsignUtils { ... } Then any SOQL you ran in there would be automatically mindful of CRUD/FLS permissions. ...
0
votes
1answer
627 views

“Sharing With Controller” Vulnerability

I got a "Sharing with Controller" Vulnerability from the Checkmarx scan. It doesn't give many details though it only flags this line in my Visualforce page: <apex:page controller="...
0
votes
1answer
143 views

Running ApexClasses in PE with Security Review and Certification

I've a managed package which I would like to be installed in a Professional Edition. When I try to install the package in the PE, I get following error, of course my package has few ApexClasses/Pages/...
0
votes
1answer
61 views

Deploy FLS settings for standard object's custom field in managed package

I've added a custom field to Activity object for using it during Task creation/updating from Apex code. By default when I deploy my project through SFDX this field has no FLS settings. In the result I ...
0
votes
1answer
88 views

Securely storing and retrieving google maps api key for appexchange app

i am planning to use google maps in one of appexchange apps. We need to store and retrieve the api key to be used for google maps. The end client would have to enter the key that they had signed up ...
0
votes
2answers
216 views

Lighhtning inline CSS alternatives

The Lightning Component that I built uses a lot of inline CSS. This is because of the configurations for certain clients who wants to give a more personal look and feel of our app. These ...
0
votes
1answer
119 views

Security Review and minified external files for Instagram

I've been using oembed, particularly for Instagram (still figuring out how to get Twitter to work), for our Lightning Component to show some Instagram post(s). I've been using the https://platform....
0
votes
1answer
47 views

Data Requirements for Security Review to test Web Services in a package

I have a package that I am trying to get through security review. The package is really an API layer that other packages rely on, so it doesn't have a UI you can submit calls through - just global ...
0
votes
1answer
57 views

AppExchange Security Review of Client

We are planning to release an offering to AppExchange. Our offering includes clients which interacts sfdc endpoints. However, the client does not interact with gzip encoding. Will it be an issue for ...
0
votes
1answer
155 views

How to install package in mobile devices through salesforce1 application or any other way

I have developed an application in a salesforce account. and I have created the package and can publish on the appexchange. Now, that uploaded application on the appexchange can be installed in ...
0
votes
0answers
35 views

Getting checkmarx FLS_Create Error in apex

Checkmarx is giving me the FLS_Create error in the below code. cv.PathOnClient = docName; cv.VersionData = requestbody; cv.ContentLocation = 'S'; cv....
0
votes
0answers
21 views

Has anyone used Lightning Out with a managed package?

I am working on an integration with a trading and rebalancing platform for a provider who also uses Salesforce Sales & Service cloud to manage their internal operations. This provider has added ...
0
votes
0answers
47 views

Cross-Site Scripting in visual force input

We have received a security warning regarding Cross-Site Scripting for below input : <apex:inputtext value="{!mergeText}" id="txtField" disabled="true" size="25"/> What changes are required to ...
0
votes
0answers
529 views

HTTP Form Post to external website from Lightning Component

I am working with a client to develop a managed package. Here is the requirement in brief: User clicks a button in a lightning component which is added to Contact detail page. The button click ...
0
votes
1answer
167 views

RichText area field not eliminating XSS issue in checkmarx

I am writing escape=false in my VF Page like this. <apex:outputText escape="false" value="{!cr.Message__c}" rendered="{!(cr.Message__c)!= ''}"/><br/><br/> The Mesage__c is a custom ...
0
votes
0answers
15 views

Safe to create custom object log records in a security-reviewed managed package app?

I want to create a logging system for our AppExchange managed package that will be recorded by Usage Metric features and will also comply with security guidelines to pass the review. To achieve this, ...
0
votes
1answer
34 views

Need help with security review

I have created a package and passed it for security review. The package passed the security review with flying colours!! All this time I installed the package in fresh org and I encountered no ...
0
votes
0answers
337 views

How to make CSS of lightning bundle dynamic

I have a component used in my org from lightning strike. This component uses innerHTML property of element to assign css classes. The code is as follows: Markup: <style aura:id="tooltipStyle"&...
0
votes
1answer
33 views

Adding new look and feel changes to the package for second attempt of security review affect the process?

We got the result for App Exchange security review as "Your App did not pass" with few issues. We have rectified those issue and also done few look and feel (added slds) changes to the Visualforce ...
0
votes
0answers
34 views

List 2 packages from 1 DE Org to Appexchange

I have a developer Org where we are creating an app for Appexchange. We created both Unmanaged and Managed forms of the same app in the Org. My question is whether its possible to get both these ...
0
votes
1answer
51 views

Security review for salesforce to salesforce integration

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance. In source instance, i have created a ...
0
votes
1answer
88 views

Scan report for custom REST service for security review. Is that mandatory?

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that ...
0
votes
0answers
47 views

Security Review-Requirements [closed]

We submitted for security review yesterday,and they have sent a mail saying few reports are not being uploaded like ZAP and also few Composite piece(s) of your application was not accessible What ...
0
votes
1answer
31 views

How to cope up with the SAP server maintenance and AppExchange security review?

we are about to submit our app for the security review. The issue would be one of SAP server which we have been using for the app development will be down for maintenance. Since the app relying on the ...
0
votes
0answers
27 views

View security review code scanner report

I have published an app on AppExchange and I had to submit zap or burpscan report. However, today I am trying to review that report but I am getting insufficient privileges error. I am not able to ...
0
votes
1answer
551 views

Stored XSS in database.query

We have submitted our code to security review. i'm facing stored xss vulnarabities as described in below lines, please some one help me on this. public map<string,RecordType> RecordTypeMap(...
0
votes
1answer
70 views

Submit app for Review

I want to publish my app on appexchange in order to do so i need to review, So while submitting my for review i am getting error at step 5. salesforce is asking for production/sandbox credentials. I ...
0
votes
1answer
262 views

Force.com Security Scanner Results - Frame Spoofing for Survey force application

I am trying to include survey force application with our existing app and creating a manage package. After submitting the code for Force.com Security review I have received below error messages: ...
-1
votes
1answer
37 views

My security review fail because of a unit class : do managed packadge really need to contains unit test class? [closed]

I'm wondering if the managed packadge need to contains all unit test class in the code base use to create de app. I have herited from a code base and managed application and the app is released with ...
-1
votes
1answer
38 views

Publish App exchange application with Scanning [duplicate]

I have created a Lightning component And Add in App Exchange my partner community. So I have passed my component in a security review. Now I can use SOURCE SCANNER for Apex class and visual force ...
-1
votes
1answer
96 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...

1 2 3 4
5