The Salesforce AppExchange Security Review: A Comprehensive Guide

When you're developing an app on Salesforce, one of the biggest hurdles you’ll face before launching on AppExchange is passing the Salesforce Security Review. This isn’t just another box to check — it’s a rigorous, in-depth evaluation designed to safeguard your app, the Salesforce platform, and your customers' data. Security breaches can damage reputations, lead to data loss, and disrupt business, so Salesforce doesn’t take any chances! 

If you're building a product that handles customer information or interacts with Salesforce’s vast ecosystem, mastering the security review process is essential. From common vulnerabilities like SOQL injection and cross-site scripting (XSS) to platform-specific issues, preparing for this review can be complex. But with the right approach, tools, and best practices, you can not only pass the review but strengthen your app’s security at every level. Let's explore what the Salesforce Security Review entails and how you can ensure your app passes it with flying colors. 

What is the Salesforce AppExchange Security Review? 

The Salesforce AppExchange Security Review is a mandatory evaluation for apps before they are listed on the AppExchange marketplace. This review assesses an app’s security to protect Salesforce's ecosystem and customer data. It identifies potential vulnerabilities that could be exploited by hackers, malware, or other threats. The review covers a wide range of security aspects, from code vulnerabilities to data protection practices. 

Common Security Threats Tested During the Review 

• SOQL Injections: Ensures protection against malicious code injection attacks. 

• Cross-Site Scripting (XSS): Validates that the app does not allow unauthorized scripts to run. 

• CRUD/FLS Enforcement: Verifies that users only access the data they're authorized to view. 

• Non-Secure Authentication Protocols: Checks for robust authentication mechanisms to prevent unauthorized access. 

• Salesforce-Specific Vulnerabilities: Evaluates record-sharing violations and other platform-specific security risks. 

Why is the Salesforce Security Review Important? 

Salesforce’s security review is critical for both developers and customers. It ensures that applications are safe, reliable, and free from vulnerabilities that could expose sensitive customer data. By successfully passing the review, developers can: 

• Build Trust: A secure app fosters trust among users and enhances its credibility. 

• Protect Data: Safeguards customer information from unauthorized access or breaches. 

• Comply with Best Practices: Aligns with Salesforce’s security standards, reducing risks for both the developer and customers. 

Key Security Considerations for a Successful Review 

1. Input Validation and SOQL Injections 

One of the most common threats is SOQL Injection, where attackers attempt to manipulate your queries by injecting malicious inputs. Ensure that all user inputs are validated and sanitized to avoid these attacks. 

For a deeper understanding, check out Salesforce’s guide on SOQL Injections. 

2. Robust Authentication and Authorization 

Implementing multi-factor authentication (MFA) and other secure access control measures can protect user accounts from unauthorized access. Ensure that your app has the proper role-based access controls in place. 

For more details, refer to Salesforce’s authentication principles. 

3. Data Encryption 

Encryption is essential for protecting sensitive data, both in transit and at rest. Use SSL/TLS to secure data during transmission and encrypt stored data to ensure its safeguarded even if accessed improperly. 

Salesforce provides more information on this here. 

4. Secure API Usage 

Ensure that OAuth or another secure authentication method is used for API calls and avoid sending sensitive information through GET requests. This minimizes the chances of sensitive data exposure. 

5. Using Secure Third-Party Libraries 

Applications often rely on third-party libraries, but these can introduce vulnerabilities if not properly maintained. Regularly update dependencies and scan for vulnerabilities using tools like OWASP Dependency-Check or Retire.js. 

You may want to read: OWASP Top 10. 

6. Code Reviews and Testing 

Regular code reviews and security testing (e.g., using SAST and DAST tools) are essential practices. They help catch vulnerabilities early in the development cycle and ensure that security is continuously monitored. 

7. Compliance with Salesforce Security Guidelines 

Ensure your app complies with Salesforce-specific security measures, such as CRUD and FLS (Field-Level Security). Violating these guidelines is a common reason for security review failures. 

Tools for a Successful Salesforce Security Review 

1. Checkmarx 

Checkmarx is a static application security testing (SAST) tool that Salesforce uses to identify vulnerabilities in the codebase. Integrating Checkmarx into your CI/CD pipeline for continuous monitoring is crucial for maintaining secure code. 

Use the Partner Security Portal to access the scanner. 

2. Salesforce Code Analyzer 

In addition to Checkmarx, the Salesforce Code Analyzer is a preferred tool for detecting violations, especially CRUD/FLS issues, which are the most common reasons for review failure. Regularly scan your app with these easy steps to ensure compliance. 

3. ZAP (OWASP ZAP) 

OWASP ZAP is an open-source tool that helps identify vulnerabilities in web applications, particularly during active and passive scans. Regularly running ZAP scans is key to detecting security risks that static analysis might miss. 

4. SSL Server Test 

Salesforce runs an SSL/TLS compliance check on any external endpoints your app uses. Ensure that your external services receive an "A" grade in SSL scans to pass the review. 

To run the scan, simply input the base URL onto this web form and hit 'Submit'. 

Documentation Required for the Security Review 

Proper documentation helps streamline the review process and demonstrates your app’s security readiness. Key documents to prepare include: 

• API Documentation: Detailing any third-party services or APIs your app integrates. 

• False Positive Reports: If false positives are identified, document why these are not valid security issues. 

• User Manuals: Outlining how the app works and user roles within the application. 

You may also need to provide supporting documents like Checkmarx reports, ZaProxy (DAST) reports, and SSL/TLS test reports. 

Preparing Test Orgs for the Security Review 

Before submitting for review, Salesforce may request access to test environments. It's important to: 

• Create a dedicated test org for the security review team. 

• Populate it with sample data and configure user roles. 

• Ensure necessary dependencies are installed and IPs are whitelisted if needed. 

Leveraging Salesforce Security Office Hours 

Salesforce offers Security Office Hours, where developers can receive guidance from security experts. These sessions are invaluable for getting direct feedback from Salesforce’s security review team. Salesforce hosts both technical and operational office hours to assist with security-related queries and submission logistics. 

The Salesforce Security Review is a critical step in ensuring that your application meets the platform’s stringent security standards. By preparing thoroughly—adhering to best practices, leveraging testing tools, and ensuring proper documentation—you can navigate the review process successfully. Ultimately, passing this review not only protects your users but also boosts your app’s credibility and adoption on the AppExchange. 

Ensure your app is secure, compliant, and ready for the future by staying proactive with Salesforce’s security guidelines and utilizing available resources. 

Important Resources for Salesforce Security Review 

To help developers navigate the Salesforce Security Review, several resources are available: 

• Checklist Builder 

To streamline the security review process, Salesforce offers a Checklist Builder. This tool allows developers to generate a security checklist customized to their solution’s architecture. By selecting relevant components (such as Lightning or Visualforce), you can compile a list of security review materials specific to your app’s needs. 

• ESLint 

ESLint is a powerful linting tool for JavaScript that enforces code quality by analyzing code for errors and enforcing consistent coding standards. The tool is widely used to ensure JavaScript code follows secure and high-quality practices, and it helps catch potential security flaws early in the development process. 

• PMD 

If your code scanner doesn’t include PMD rules, integrating Programming Mistake Detector (PMD) is recommended. PMD is a static source code analyzer that supports multiple languages, including Apex, Java, and Visualforce. It helps identify common coding mistakes such as empty catch blocks, unused variables, and suboptimal code, ensuring your app follows best practices and is secure. 

Most Common Violations in Security Review 

Salesforce has identified a list of the most common security violations found during reviews. These typically include issues like CRUD/FLS violations, improper input handling, and authentication weaknesses. Familiarizing yourself with these common violations helps you proactively address potential pitfalls. 

For a complete list, refer to Salesforce’s guide on security violations. 

The Salesforce Security Review is a critical step in ensuring that your application meets the platform’s stringent security standards. By preparing thoroughly—adhering to best practices, leveraging testing tools, and ensuring proper documentation—you can navigate the review process successfully. Ultimately, passing this review not only protects your users but also boosts your app’s credibility and adoption on the AppExchange. 

Ensure your app is secure, compliant, and ready for the future by staying proactive with Salesforce’s security guidelines and utilizing available resources. 

Read other Extentia blog posts here!