FAQ-000828 - External Platform Security / External Dependencies and Libraries

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
Can security issues in external dependencies cause my package to fail review?
Answer
Yes, security issues in external dependencies can cause your package to fail the AppExchange security review. The review process includes testing all external components, like web applications or services, to ensure they securely handle Salesforce credentials and data. Addressing any vulnerabilities in these dependencies before submission is crucial to avoid delays or failure in the review process.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
LibraryWithKnownCriticalSeverityVulnerabilityLibraryWithKnownHighSeverityVulnerabilityLibraryWithKnownMediumSeverityVulnerabilityLibraryWithKnownLowSeverityVulnerabilityApexInsecureEndpointApexSuggestUsingNamedCredAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInHttpHeaderAvoidHardcodedCredentialsInVarAssignAvoidHardcodedCredentialsInVarDecls
Question
Can security issues in external dependencies cause my package to fail review?
Recommended Answer Update
Yes, security issues in external dependencies can cause your package to fail the AppExchange security review. The review process includes testing all external components, like web applications or services, to ensure they securely handle Salesforce credentials and data. This includes checking for known vulnerabilities in JavaScript libraries and ensuring secure communication with external endpoints. Addressing any vulnerabilities in these dependencies before submission is crucial to avoid delays or failure in the review process.
Reasoning
The existing answer is accurate but could be more specific about the types of security issues that are checked. I added a sentence mentioning JavaScript libraries and secure communication with external endpoints to better align with the security scanner rules that actually detect these issues. The core message and structure remain the same, but this addition provides more concrete examples of what external dependency security issues entail. Regarding the selected security rules: 1. LibraryWithKnownCriticalSeverityVulnerability, LibraryWithKnownHighSeverityVulnerability, LibraryWithKnownMediumSeverityVulnerability, LibraryWithKnownLowSeverityVulnerability - These rules directly relate to the FAQ's discussion of 'security issues in external dependencies' as they specifically detect known vulnerabilities in JavaScript libraries used in packages. 2. ApexInsecureEndpoint - This rule relates to the FAQ's mention of 'external components, like web applications or services' by detecting insecure HTTP endpoints in external communications. 3. ApexSuggestUsingNamedCred - This rule connects to the FAQ's point about 'securely handle Salesforce credentials' by promoting secure credential management for external service connections. 4. AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInHttpHeader, AvoidHardcodedCredentialsInVarAssign, AvoidHardcodedCredentialsInVarDecls - These rules all relate to the FAQ's emphasis on 'securely handle Salesforce credentials and data' by detecting hardcoded credentials that could compromise security when connecting to external dependencies.
Reasoning References