FAQ-000755 - Development and Sample Code Security / Sample Code Impact on Security Review

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
How should development and sample code be managed to avoid security review issues and failures?
Answer
Yes, including sample or test code in a managed package can cause a security review to fail. To manage development and sample code effectively and avoid security review issues, follow these guidelines: 1. **Remove Sample Code Before Submission**: It's recommended to remove any sample code before submission, as it may be flagged as a security concern. 2. **Avoid Using Sample Code in Production**: Use sample code only for learning purposes. Write your own production code to ensure it meets security standards and avoids vulnerabilities. 3. **Follow Secure Coding Practices**: Adhere to Salesforce's secure coding guidelines, avoiding risky practices like direct DOM manipulation. 4. **Test and Scan Code Regularly**: Use tools like Salesforce Code Analyzer and Source Code Scanner to identify and address vulnerabilities. 5. **Document False Positives**: If there are false positives, document them thoroughly to explain why they are non-exploitable or irrelevant. 6. **Avoid Common Violations**: Do not include dynamically loaded third-party JavaScript or CSS files from external sources. Use static resources instead and ensure secure communication protocols like HTTPS. 7. **Manually Test the Solution**: Perform manual testing to catch vulnerabilities that automated tools might miss. 8. **Prepare for Security Review**: Ensure your solution is secure, Lightning Ready, and thoroughly tested. Submit all required materials, including scan reports and false-positive documentation, through the AppExchange Partner Console. These practices will help minimize security risks and improve your chances of passing the security review.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
LoadJavaScriptHtmlScriptLoadJavaScriptIncludeScriptLoadCSSLinkHrefLoadCSSApexStylesheetAvoidCreateElementScriptLinkTagAvoidInsecureHttpRemoteSiteSettingAvoidDisableProtocolSecurityRemoteSiteSetting
Question
How should development and sample code be managed to avoid security review issues and failures?
Recommended Answer Update
Yes, including sample or test code in a managed package can cause a security review to fail. To manage development and sample code effectively and avoid security review issues, follow these guidelines: 1. **Remove Sample Code Before Submission**: Remove any sample code before submission, as it may be flagged as a security concern. 2. **Avoid Using Sample Code in Production**: Use sample code only for learning purposes. Write your own production code to ensure it meets security standards and avoids vulnerabilities. 3. **Follow Secure Coding Practices**: Adhere to Salesforce's secure coding guidelines, avoiding risky practices like direct DOM manipulation. 4. **Test and Scan Code Regularly**: Use tools like Salesforce Code Analyzer and Source Code Scanner to identify and address vulnerabilities. 5. **Document False Positives**: If there are false positives, document them thoroughly to explain why they're non-exploitable or irrelevant. 6. **Avoid Common Violations**: Don't include dynamically loaded third-party JavaScript or CSS files from external sources. Use static resources instead and ensure secure communication protocols like HTTPS. 7. **Manually Test the Solution**: Perform manual testing to catch vulnerabilities that automated tools might miss. 8. **Prepare for Security Review**: Ensure your solution is secure, Lightning Ready, and thoroughly tested. Submit all required materials, including scan reports and false-positive documentation, through the AppExchange Partner Console. These practices will help minimize security risks and improve your chances of passing the security review.
Reasoning
The FAQ content is accurate and comprehensive. I made minor improvements to reduce verbosity and improve clarity while preserving all original points: - Simplified "It's recommended to remove" to "Remove" for more direct language - Changed "they are non-exploitable" to "they're non-exploitable" for conversational tone - Changed "Do not include" to "Don't include" for conversational tone No outdated content was detected - all recommendations align with current security practices. For security rules selected: - LoadJavaScriptHtmlScript and LoadJavaScriptIncludeScript: Directly relate to point #6 about avoiding "dynamically loaded third-party JavaScript...from external sources" which these rules detect - LoadCSSLinkHref and LoadCSSApexStylesheet: Relate to point #6 about avoiding "dynamically loaded third-party...CSS files from external sources" which these rules flag - AvoidCreateElementScriptLinkTag: Connects to point #3's "risky practices like direct DOM manipulation" as this rule prevents dynamic script/link creation - AvoidInsecureHttpRemoteSiteSetting and AvoidDisableProtocolSecurityRemoteSiteSetting: Relate to point #6's requirement to "ensure secure communication protocols like HTTPS" - these rules enforce HTTPS usage and prevent insecure HTTP connections
Reasoning References