FAQ-001679 - Security Configuration Requirements / Pre-Submission Security Requirements

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
What are the mandatory security checks and configurations, such as permission sets, required before submitting for review?
Answer
Before submitting for AppExchange Security Review, you need to complete the following mandatory security checks and configurations: 1. **Secure the Solution**: Ensure it adheres to industry security standards, protecting customer data and addressing vulnerabilities. 2. **Permission Sets**: Configure permission sets to limit user access to necessary data and functionality, following CRUD (Create, Read, Update, Delete) and FLS (Field-Level Security) guidelines. 3. **Testing**: Conduct end-to-end testing, including manual and automated scans with tools like Salesforce Code Analyzer and Source Code Scanner. Address vulnerabilities or document false positives. 4. **Documentation**: Provide detailed user documentation, security scan reports, and explanations for false positives, along with your company's security policies. 5. **Managed Package**: Submit a Managed—Released package, as unmanaged or beta packages are not accepted. 6. **Environment Access**: Grant access to all environments, packages, and external components used by the solution, including web, client, or mobile applications. 7. **Lightning Ready Certification**: Certify that the solution is Lightning Ready, as this is required for new solutions. 8. **Partner Program Enrollment**: Ensure enrollment in the AppExchange Partner Program and have a distribution agreement in place. 9. **Test Environment**: Set up a Developer Edition org with the distribution-ready version of the solution installed for the review team. 10. **Security Review Wizard**: Use the security review wizard in the AppExchange Partner Console to submit the solution and required materials. Following these steps ensures your solution is ready for the review process.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexCRUDViolationApexSharingViolationsAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInVarAssignAvoidHardcodedCredentialsInVarDeclsApexSuggestUsingNamedCredApexInsecureEndpointApexSOQLInjectionApexXSSFromEscapeFalseApexXSSFromURLParamVfUnescapeElVfCsrf
Question
What are the mandatory security checks and configurations, such as permission sets, required before submitting for review?
Recommended Answer Update
Before submitting for AppExchange Security Review, you need to complete the following mandatory security checks and configurations: 1. **Secure the Solution**: Ensure it adheres to industry security standards, protecting customer data and addressing vulnerabilities. 2. **Permission Sets**: Configure permission sets to limit user access to necessary data and functionality, following CRUD (Create, Read, Update, Delete) and FLS (Field-Level Security) guidelines. 3. **Testing**: Conduct end-to-end testing, including manual and automated scans with tools like Salesforce Code Analyzer and Source Code Scanner. Address vulnerabilities or document false positives. 4. **Documentation**: Provide detailed user documentation, security scan reports, and explanations for false positives, along with your company's security policies. 5. **Managed Package**: Submit a Managed—Released package, as unmanaged or beta packages aren't accepted. 6. **Environment Access**: Grant access to all environments, packages, and external components used by the solution, including web, client, or mobile applications. 7. **Lightning Ready Certification**: Certify that the solution is Lightning Ready, as this is required for new solutions. 8. **Partner Program Enrollment**: Ensure enrollment in the AppExchange Partner Program and have a distribution agreement in place. 9. **Test Environment**: Set up a Developer Edition org with the distribution-ready version of the solution installed for the review team. 10. **Security Review Wizard**: Use the security review wizard in the AppExchange Partner Console to submit the solution and required materials. Following these steps ensures your solution is ready for the review process.
Reasoning
The FAQ content is accurate and comprehensive. Minor improvements were made to enhance readability and tone consistency with the brand guidelines: changed 'are not accepted' to the more conversational 'aren't accepted' to align with the guideline to use contractions. This makes the content more approachable while maintaining all technical accuracy. Regarding security rules, this FAQ covers pre-submission requirements that directly relate to multiple security scanner rules: - ApexCRUDViolation and ApexSharingViolations relate to the CRUD and FLS guidelines mentioned in point 2 about permission sets - AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInVarAssign, and AvoidHardcodedCredentialsInVarDecls relate to protecting customer data and addressing vulnerabilities mentioned in point 1 - ApexSuggestUsingNamedCred relates to securing solutions and protecting data through proper credential management - ApexInsecureEndpoint relates to ensuring industry security standards are followed - ApexSOQLInjection, ApexXSSFromEscapeFalse, ApexXSSFromURLParam, VfUnescapeEl, and VfCsrf all relate to the security vulnerabilities that need to be addressed as part of the testing and security standards mentioned in points 1 and 3
Reasoning References