ISVforce Guide
Newer Version Available
Pass the AppExchange Security Review
The description of the AppExchange Security Review in this section and the links herein is current as of the listed effective date. SFDC may update or modify the AppExchange Security Review from time to time in its sole discretion, with or without notice.
Note
Partner Applications, which includes managed packages, Salesforce Platform API solutions, Marketing Cloud API solutions, and other solutions referred to herein, are Non-SFDC Applications as defined in Salesforce’s Main Services Agreement (available at https://www.salesforce.com/company/legal/agreements or successor URL). Notwithstanding any security review of a Partner Application, Salesforce makes no guarantees regarding the quality or security of any Partner Application and Customers are responsible for evaluating the quality, security, and functionality of Partner Applications.
Important
-
AppExchange Security Review
Before you can publicly list your managed package, Salesforce Platform API solution, or Marketing Cloud API solution on AppExchange, it must pass a security review. The AppExchange security review tests the security posture of your solution, including how well it protects customer data. -
How Does AppExchange Security Review Work?
Before initiating an AppExchange security review, you perform your own testing and gather supporting materials that help us assess the security of your solution. During a review, our Product Security team attempts to identify security vulnerabilities in your solution. If the team identifies vulnerabilities, you have access to personalized technical guidance to help you address the identified vulnerabilities. -
Partner Security Portal
The Partner Security Portal is the main hub for your security review needs. The portal hosts the Source Code Scanner (Checkmarx) and Chimera automated security scanning tools. Use these tools to identify security vulnerabilities in your solution. The portal is also where you go to schedule office hours appointments with AppExchange security engineers and Security Review Operations team members. Office hours provide a forum for you to ask questions about the security review process and to discuss how to rework code that has security vulnerabilities. -
Test Your Entire Solution
Test the full scope of your solution using manual testing and automated security scanner tools. When you perform security scans, include all external endpoints that run independently of the Salesforce platform. Document false positive security violations and fix all code that doesn’t meet Salesforce security guidelines. -
False Positives
As you navigate the AppExchange security review process, you're likely to encounter false positive issues with your solution. A false positive occurs when a security-scanning tool or code reviewer flags code that appears to pose a security vulnerability but actually doesn’t. Instead, the flagged vulnerability is nonexistent, nonexploitable, or not required to support a valid use case or functionality. -
Security Review Resources
These resources can help you prepare for the AppExchange security review.