Common Reasons for Returned Submissions

Security Review commonly returns Flow connector submissions for these reasons.

• Hardcoded credentials in DataWeave.
• Calls to log() that include payload or composite values.
• Operations that return raw upstream payloads without explicit field filtering.
• Error paths that propagate raw upstream error bodies to Flow.
• Use of MD5, SHA1, or default hashWith for security-sensitive operations.
• Missing input validation on Flow Builder inputs.
• DataWeave that calls eval, run, evalUrl, or runUrl with user-controlled parameters.
• Calls to readUrl without scheme or host allowlisting.

Submit a Salesforce Code Analyzer report with the Custom rules applicable to Flow connectors as part of your Security Review materials.