Common Reasons for Returned Submissions

Security Review commonly returns Flow connector submissions for these reasons.

Hardcoded credentials in DataWeave.
Calls to log() that include payload or composite values.
Operations that return raw upstream payloads without explicit field filtering.
Error paths that propagate raw upstream error bodies to Flow.
Use of MD5, SHA1, or default hashWith for security-sensitive operations.
Missing input validation on Flow Builder inputs.
DataWeave that calls eval, run, evalUrl, or runUrl with user-controlled parameters.
Calls to readUrl without scheme or host allowlisting.

Submit a Salesforce Code Analyzer report with the Custom rules applicable to Flow connectors as part of your Security Review materials.