FAQ-000383 - Common Security Vulnerability Resolution / Network Security Configuration

To resolve insecure software version and TLS/SSL configuration issues: 1. **Insecure Software Versions**: - Upgrade outdated libraries or components to their latest stable versions (e.g., Bootstrap, jQuery). - Remove references to third-party sites hosting outdated versions. - Document these updates and include them in your submission. 2. **TLS/SSL Configuration**: - Identify third-party sites using outdated protocols like TLS 1.0 or 1.1. - Request the third-party provider to upgrade to supported versions (TLS 1.2 or higher). - If the third-party site can't comply, remove references to it from your package. - Document these actions and provide evidence of remediation during the security review process. Taking these steps helps address these issues effectively and ensures your app meets AppExchange security standards.

The FAQ content is accurate and comprehensive. Minor improvements were made to enhance clarity and tone: changed 'e.g., TLS 1.2 or higher' to 'TLS 1.2 or higher' for better flow, changed 'cannot comply' to the more conversational 'can't comply', and enhanced the closing statement to be more specific about AppExchange security standards rather than just being 'effective'. These changes align with the brand guidelines for being more conversational and positive while maintaining technical accuracy. Regarding security rules selection: ApexInsecureEndpoint relates to the FAQ's discussion of identifying and resolving insecure endpoints and TLS/SSL configuration issues. AvoidDisableProtocolSecurityRemoteSiteSetting and AvoidInsecureHttpRemoteSiteSetting directly relate to the TLS/SSL configuration content, as they deal with secure protocol configurations for remote sites. The LibraryWithKnown*SeverityVulnerability rules (Critical, High, Medium, Low) all relate to the FAQ's discussion of 'insecure software versions' and upgrading outdated libraries or components like Bootstrap and jQuery, as these rules detect libraries with known vulnerabilities that need to be upgraded.