Pass the AppExchange Security Review on the First Try

TL;DR: The Salesforce security review checklist is the set of controls Salesforce's Product Security team verifies before a managed package goes live on AppExchange: enforced CRUD/FLS and sharing, no injection flaws, encrypted data, documented data flows, and clean scanner reports. Pass on the first try by running the required scans, fixing every violation you can, and documenting the rest. Below is the working checklist and the mistakes that trigger a resubmission.

What is the Salesforce security review?

The security review is a mandatory audit Salesforce runs on every managed package before it can be listed on AppExchange. It combines static code analysis, dynamic application testing, and a manual pass by Salesforce's Product Security team. The submission fee is $999 for paid solutions (free listings pay nothing), and a solution typically takes 4-5 weeks to clear the process. Scans do not need to be 100% clean; you run them, fix what you can, and explain the rest.

What is on the Salesforce security review checklist?

Every item below maps to something a reviewer will actively try to break. Treat it as a pre-submission gate, not a wish list.

1. Enforce CRUD and FLS. Every query and DML operation must respect the running user's object and field permissions. Use WITH USER_MODE on SOQL and AccessLevel.USER_MODE on Database calls, plus Security.stripInaccessible() for payloads you filter yourself. Hand-rolled isAccessible()/isUpdateable() chains are easy to leave incomplete.
2. Respect sharing. Declare with sharing on Apex classes that touch records, and never widen access to dodge a sharing rule.
3. Kill injection. Use bind variables, not string concatenation, in SOQL and SOSL. Escape anything dynamic.
4. Encrypt data. AES-256 for data at rest, TLS 1.2 or higher in transit.
5. Protect secrets. Store credentials in Named Credentials or protected custom metadata, never hardcoded in Apex or a component.
6. Use OAuth for every external system connection instead of storing raw usernames and passwords.
7. Harden the front end. Set security headers and mark cookies Secure and HttpOnly.
8. Run the scanners and document false positives. A false positive without an explanation reads as an unaddressed vulnerability.
9. Document everything. Architecture, data-flow diagrams between your org and any external site, API callouts, and working test credentials.

Which scanners does Salesforce require you to run?

For a managed package you must upload Salesforce Code Analyzer reports. Generate them with the AppExchange rule set:

sf code-analyzer run --rule-selector AppExchange --rule-selector Recommended:Security --output-file CodeAnalyzerReport.html

Salesforce also runs static analysis with Checkmarx and dynamic testing with tools such as OWASP ZAP or Burp Suite. (The older Chimera scanner was retired.) Remember: the requirement is that you ran the scans and remediated what you could, not that every rule passes.

Why do apps fail the security review?

Most first-attempt failures cluster around a short list of issues:

• Missing CRUD or FLS checks on a single object or field.
• Apex that runs without sharing where it should not.
• SOQL injection through dynamic queries.
• Sensitive data stored or logged in the clear.
• Undocumented false positives in the scanner reports.

None of these are exotic. They slip through because they were caught late, after the code was written, rather than enforced as the package evolved.

How does submission quality speed up the review?

A human reviews your submission, and the quality of what you hand them shapes how fast it clears. Handing everything over up front - complete data-flow diagrams, a clear false-positive log, responsive contacts, and test credentials that actually work - removes the back-and-forth that stretches a review into extra weeks. The same instinct that makes good customer service, anticipating the other person's next question, is exactly what shortens a security review.

The teams that pass cleanly treat the review as a continuous discipline, wiring CRUD/FLS enforcement and scanner runs into their release pipeline so the package is review-ready every sprint, not scrambled together the week before submission. That is the DevOps posture we build with clients at Tekunda.

FAQ

How much does the Salesforce security review cost?

$999 per attempt for paid solutions, including each resubmission after a failure. Free listings are not charged the fee.

How long does the security review take?

A solution typically takes 4-5 weeks to move through review, longer if it comes back for remediation.

Do my scanner reports need to pass 100%?

No. You must run the scans, fix every violation you can, re-run them, and document any remaining false positives.

Is the security review a one-time event?

No. Salesforce periodically requires re-review, and every new feature you ship should meet the same bar, so the checklist is an ongoing standard.