ISVforce Guide

ISVforce Guide: Build and Distribute AppExchange Solutions
Get Ready to Distribute on AppExchange
Use Managed Packages to Develop Your AppExchange Solution
Manage Orgs with Environment Hub
Architectural Considerations for Group and Professional Editions
Security Requirements for AppExchange Partners and Solutions
Security Policy Requirements
Prevent Secure Coding Violations
Secure Your B2C Commerce Solution
Secure Your Tableau Accelerator
Secure Your Agentforce Solution
Secure Your Connected Apps and External Client Apps
Secure Your Flow Connectors
Protect Credentials and Sensitive Data
Don't Run Untrusted Code or Make Untrusted Calls
Validate Input from Flow Builder
Filter Response Data
Handle Errors Without Leaking Information
Use Strong Cryptography
Bound Resource Use
Handle Specialized Data Formats Carefully
Other Considerations
Common Reasons for Returned Submissions
Where to Get Help
Pass the AppExchange Security Review
Manage Your AppExchange Listings
AgentExchange Go-To-Market App Guide
Sell on AgentExchange with Checkout
Report Orders to Salesforce with the Channel Order App
Provide Free Trials of Your AppExchange Solution
OEM User License Guide
PDF

Other Considerations

These topics cover additional guidance from the DataWeave Secure Coding Guidelines. They apply to related runtimes outside the Flow connector context, or are awareness items worth noting for future releases.

Patterns from Related Runtimes

These items describe DataWeave functions that exist in related runtimes but aren't typical in the Flow connector context.

Flow invocation via Mule::lookup. Mule::lookup(flowName, payload, timeout) invokes flows by name and is deprecated in MuleSoft (use Flow Ref with the target attribute instead). If your connector uses this pattern in another runtime context, validate the flow name against an allowlist before invocation to prevent unintended flows from running.

Theoretical and Future Risks

These items describe theoretical risks or apply to future framework capabilities.

Time-of-check, time-of-use (TOCTOU). "Time-of-check, time-of-use" describes a window between validating remote content and using it. As a best practice, read a URL once into a variable and reuse the variable for validation and processing.

OAuth 2.0 implicit grant. defineOAuth2Connection() with grantType: "implicit" returns the access token directly in the redirect URI's URL fragment. That token can leak through browser history, Referer headers, or third-party scripts on the consent page. OAuth 2.1 deprecates the implicit grant, and OAuth-based connections aren't part of the current Flow connector framework GA scope. If OAuth is added in a future release, use grantType: "authorizationCode" with PKCE, not the implicit grant.