2 posts tagged with "AgentExchange Security Review"

Every package that goes through the AgentExchange (formerly AppExchange) Security Review arrives with scanner output, and almost all scanner output contains false positives. A CRUD finding on a custom setting. A sharing finding on a class that declares inherited sharing. A SOQL injection finding on a query where every value is a bind. The security review false positive document is where you explain each of those, and it decides whether a reviewer spends their time on your real risks or on questions about your noise.

Salesforce treats the document as part of the submission. Its packaging guide has a page on how to document your responses to false positives, offers a template, and asks for the code location and the reason the code is not vulnerable for each flagged issue. If the explanation will not hold up, the guidance is to change the code instead.

A failed AgentExchange (formerly AppExchange) Security Review rarely fails on something exotic. It fails on a query that skipped a field-level check, a class that forgot its sharing keyword, or a Visualforce page that printed a URL parameter as raw HTML. The fixes are usually small. The cost of finding them in the review instead of before it is not.

Three facts about that cost, stated carefully. Salesforce publishes no first-pass failure rate; about half is the figure partners cite most often for first submissions, and it is an industry estimate, not an official one. On a paid solution, Salesforce charges a $999 fee for the initial submission and for every later attempt, and a solution typically takes four to five weeks to get through review (Salesforce). Salesforce has since renamed it the AgentExchange Security Review. The weeks are spent in the queue; the way to save them is to find the issues while you develop.