Code quality issues are not explicitly required to be fixed for security review approval. However, all security vulnerabilities identified during the review must be addressed. Fixing code quality issues is recommended, as they can often lead to security vulnerabilities, and any flagged issues that are false positives should be documented appropriately.
To understand and resolve Code Quality category issues in the AppExchange Security Review, you can use the following resources:
1. **Salesforce Code Analyzer**: Supports multiple engines like PMD, ESLint, RetireJS, and Salesforce Graph Engine to identify code quality issues, including CRUD/FLS violations.
2. **Source Code Scanner (Checkmarx)**: Available on the Partner Security Portal, it helps identify security vulnerabilities in your solution.
3. **Manual Testing**: Perform manual testing alongside automated scans to catch issues that automated tools might miss.
4. **Technical Office Hours**: Schedule appointments with Product Security engineers through the Partner Security Portal for guidance on resolving code quality issues.
5. **Documentation of False Positives**: Document any false positives identified during scans and submit them for review.
6. **Security Review Wizard**: Use this tool in the AppExchange Partner Console to track submission progress, review feedback, and communicate with the security review team.
These resources provide a comprehensive approach to effectively addressing code quality issues.