Create a Secure Solution

Designate a Security Expert

Protecting your solution from security threats is easier when you integrate security considerations into all stages of development. One of the best ways to ensure that your solution follows security guidelines is to designate a security expert on your development team.

Have your entire development team collaborate with the security expert through all stages of development: design, implementation, and testing. Postponing security considerations until the final stages of development increases the likelihood that your team unknowingly propagates security violations as they code.

Regular collaboration prevents needless accumulation of security violations, and helps avoid delays in preparing a successful AppExchange security review submission.

Learn How to Develop Secure Web Solutions

In Prevent Common Violations of Secure Coding Guidelines and in the Secure Coding Guide, learn how to identify, prevent, and remediate security violations in solutions built on or integrated with the Salesforce Platform. Find out which violations most commonly appear, why they pose security risks, and how to avoid them in your code.

Review the AppExchange Security Requirements

The AppExchange Security Requirements Checklist is our most comprehensive information resource for evaluating the security of your solution. To understand our baseline technical security requirements, review this checklist. As you develop your solution, meet the security requirements that apply to your code.

Be sure to parse through the entire AppExchange Security Requirements Checklist. Requirements that apply to your solution can be spread out in various sections. However, the Best Practices for Security section applies to all solutions.

Follow Open Web Application Security Project Guidance

The Open Web Application Security Project (OWASP) website provides comprehensive information about web app security risks. It includes detailed guidance on how to test for, prevent, and resolve security issues. Familiarize yourself with the key resources on the OWASP website.

We recommend that you use the OWASP Top Ten Project as a primary reference for securing your solution. This section of the OWASP site documents the 10 most prominent security risks that appear in web apps. The guidelines are especially pertinent to web apps and services that aren’t hosted on the Salesforce Platform.

Aim to follow development practices and security guidelines that conform as closely as possible to the OWASP Secure Coding Practices - Quick Reference Guide.