As an ISV partner submitting your managed package for security review, you must scan it with the Salesforce Code Analyzer and provide test results in your solution’s AgentExchange Security Review submission. This scan is in addition to the scan that you must complete using the Source Code Scanner, also referred to as the Checkmarx scanner.
| User Permissions Needed | |
|---|---|
| To access the Partner Community, Partner Console, and AgentExchange Security Review: | Manage Listings |
When you submit your code and scan report to the AgentExchange Security Review, it’s not necessary for the scans to be 100% passing. The main requirement is that you run the scans, address all the violations you can fix, re-run the scans, and then submit the report. Some violations, like false positives, may not be fixable. The AgentExchange Security team understands these situations and adjusts their review accordingly.
Tip
You use Salesforce CLI commands to generate the AgentExchange Security Review. See Install the Code Analyzer Plugin into Salesforce CLI to learn how to install the necessary software on your computer.
Store your managed package’s code locally on your computer. Ensure that the code version matches the package you’re submitting for security review.
In Terminal or your favorite command-line interface, change to the top-level directory of your package’s code.
Run this command to scan your code using the required rules. The command generates an HTML report with the results.
1sf code-analyzer run --rule-selector AppExchange --rule-selector Recommended:Security --output-file CodeAnalyzerReport.htmlDepending on the complexity of your codebase, the scan of your code can take a few hours.
Fix any issues that Code Analyzer identifies.
Rescan using the same command and save your HTML report file.
Document any false positives.
Upload your clean CodeAnalyzerReport.html file to your security-review submission.
If you have false-positive documentation, upload that too.
If you’re unable to run the Code Analyzer CLI commands successfully, read the Salesforce Code Analyzer documentation. If you still need help, log an issue in the Salesforce Code Analyzer GitHub repository, and provide information about the errors that you encountered when generating the scan report for your security-review submission.
j