FAQ-001545 - Proactive Security Architecture Review / Readiness Assessment and Pre-Checks

To ensure readiness for security review discussions of sophisticated integrations, follow these proactive steps: 1. **Secure Your Solution**: Align with industry best security standards and Salesforce security guidelines. 2. **Comprehensive Testing**: Use manual testing and automated tools like Salesforce Code Analyzer and Source Code Scanner (Checkmarx). 3. **Document False Positives**: Prepare detailed explanations for any false-positive security violations. 4. **Enforce CRUD/FLS**: Use WITH USER_MODE for SOQL queries and AccessLevel.USER_MODE for Database methods to automatically enforce field accessibility. You can also explicitly check field accessibility using Schema.sObjectType before performing DML operations. 5. **Address Vulnerabilities**: Mitigate risks like CSRF and SOQL injection with proper input validation, random tokens, and secure coding practices. 6. **Prepare Submission Materials**: Include test environments, credentials, and documentation for external integrations. 7. **Consult Security Engineers**: Schedule office hours via the Partner Security Portal for guidance on the review process. 8. **Review Security Guidelines**: Familiarize yourself with the AppExchange Security Review Guide to understand assessed vulnerabilities. 9. **Ensure Lightning Readiness**: Confirm your solution is Lightning Ready and connected to the AppExchange Partner Console. 10. **Periodic Updates**: Regularly review and update your solution to comply with evolving security standards. These steps will help you effectively address potential vulnerabilities and streamline the security review process.

The main update needed is in point 4 about CRUD/FLS enforcement. The current text only mentions the legacy approach of using Schema.sObjectType checks, but according to the security approaches guidelines, modern features like WITH USER_MODE and AccessLevel.USER_MODE should be prioritized as they automatically enforce permissions while requiring less code. I've updated this to lead with the modern approach while preserving the existing legacy approach as a valid alternative. I also made a minor clarification in point 5, changing 'SQL injection' to 'SOQL injection' since we're in the Salesforce context where SOQL injection is the relevant vulnerability. For security rules selection: - ApexCRUDViolation: Directly relates to point 4's discussion of enforcing field accessibility and CRUD operations - ApexSharingViolations: Related to the overall security practices and data access controls mentioned - ApexCSRF: Specifically mentioned in point 5 as a vulnerability to address - ApexSOQLInjection: Related to point 5's mention of SQL/SOQL injection mitigation - ApexSuggestUsingNamedCred: Relates to secure coding practices and external integrations mentioned in points 1 and 6 - AvoidHardcodedCredentials rules (multiple): Related to secure coding practices mentioned in point 5 and preparation materials in point 6 - AvoidSecurityEnforcedOldApiVersion: Relates to point 10 about keeping solutions updated with evolving security standards