ISVforce Guide

Welcome to the ISVforce Guide
ISVforce Quick Start
Grow Your AppExchange Business
Design and Build Your Solution
Package and Test Your Solution
Pass the AppExchange Security Review
Security Review
Required Materials for Security Review Submission
Security Review Steps
Security Review Wizard
False Positives
Document Your Responses to False Positives
Example Responses to False Positives in Checkmarx Scan Results
Example Responses to False Positives in a Security Review Failure Report
Submit a Client or Mobile App for Security Review
Submit an Extension Package for Security Review
Security Review Resources
Security Review FAQ
Publish Your Solution on AppExchange
Monitor Performance with Analytics for AppExchange Partners
Manage Orders
Manage Licenses
Manage Features
Provide a Free Trial of Your Solution
Support Your AppExchange Customers
Update Your Solution
Appendices
Glossary
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Document Your Responses to False Positives

Most often, false positives appear in Checkmarx, Chimera, ZAP, or Burp Suite scanner results. False positives also occasionally show up in Salesforce security review failure reports. In either case, you can improve your likelihood of passing security review by including a false-positive explanatory document when you submit your code.

You can use any format to document a false-positive response. For each flagged issue, include:

  • Location—State the code location of the reported vulnerability.
  • Explanation—Explain why the flagged code doesn’t pose a vulnerability.

In addition to providing rationales for false positives, include in your documentation explanations to clarify special use cases, circumstances, or exceptions.

Some categories of security scan results are false positives that don't require documentation or code reworking. These categories exist in most, but not all, security scanners that we accept for security review. Other scan results fall into severity categories that require attention. These flagged issues require your attention because they highlight known security vulnerabilities. If you can’t submit justifiable false positive documentation, rework the flagged code lines to meet security standards.

Scanner Scan Results Requiring Attention for Security Review Scan Results Not Requiring Attention
Checkmarx (Force.com source code scanner) All issues regardless of severity level, except for issues labeled “Code Quality” Issues labeled “Code Quality” don’t require code reworking or a false positive explanation.
ZAP and Burp Suite Issues categorized as high severity Action on low and medium severity issues isn’t required, but investigation into whether they pose a security threat is encouraged.
Chimera All issues regardless of severity level, except for issues labeled “Informational/Other” Issues with a risk level of “Informational/Other” don’t require code reworking or a false positive explanation.