My component was flagged for a CSRF vulnerability on load, but it does not perform any DML. How do I report this as a false positive?
Answer
To report a false positive CSRF vulnerability flagged during the AppExchange Security Review:
1. **Document the False Positive**: Create a report explaining why the flagged issue does not pose a security risk.
2. **Upload the Documentation**: Go to the AppExchange Partner Console, navigate to the Overview page, and upload the false-positive documentation to the security review wizard.
3. **Resubmit for Review**: Resubmit your solution for review. There is no fee for evaluating false-positive documentation.
My component was flagged for a CSRF vulnerability on load, but it does not perform any DML. How do I report this as a false positive?
Recommended Answer Update
To report a false positive CSRF vulnerability flagged during the AppExchange Security Review:
1. **Document the False Positive**: Create a report explaining why the flagged issue doesn't pose a security risk.
2. **Upload the Documentation**: Go to the AppExchange Partner Console, navigate to the Overview page, and upload the false-positive documentation to the security review wizard.
3. **Resubmit for Review**: Resubmit your solution for review. There's no fee for evaluating false-positive documentation.
Reasoning
The FAQ content is accurate and well-structured. I made minor language refinements to improve readability: changed "does not pose" to "doesn't pose" and "There is no fee" to "There's no fee" to follow the conversational tone guidelines. These small changes make the text more natural and user-friendly while preserving all the original information and structure.
For security rules, I selected ApexCSRF and VfCsrf because they are the two CSRF detection rules that would flag the type of vulnerability mentioned in the FAQ. The FAQ question specifically mentions "My component was flagged for a CSRF vulnerability on load" - this directly relates to ApexCSRF (severity 1, apex rule for CSRF detection) and VfCsrf (severity 2, visualforce rule for CSRF detection). These are the exact rules that would generate the false positive flags that developers need to address through the process described in this FAQ answer.