Salesforce Security Review: Running Your Own Dynamic Scans After Chimera

TL;DR: Salesforce retired its hosted Chimera dynamic scanner on 2025-06-16, so partners now run their own dynamic (DAST) scan and submit the results with their AppExchange security review. Point an accepted tool such as OWASP ZAP, Burp Suite or Qualys at a full install, keep proof you scanned the right endpoint, and document every finding you triaged. This guide covers what changed, which tools qualify, how to produce a submission-ready report, and the mistakes that send one back.

For years Salesforce ran the dynamic scan for you through Chimera. That service is gone. The static analysis and manual review are unchanged, but the dynamic scan is now yours to run and yours to evidence. This guide covers that one shift. For the failure modes that send submissions back and the order to fix them in, see Salesforce Security Review Checklist: What to Fix, In Order.

What changed when Chimera retired?

Chimera was Salesforce's hosted service that dynamically tested a partner's external endpoints during the review. Since it retired on 2025-06-16, partners submitting a managed package run their own dynamic scan against any service the package calls and attach the report to the submission. Salesforce still performs static analysis and manual review; only the dynamic testing moved to you.

If your package only ever calls Salesforce APIs and hosts nothing external, you may have little to scan. The moment your app talks to a service you operate, that service is in scope and needs its own report.

Which dynamic scan tools does Salesforce accept?

You pick the tool, as long as it produces a credible DAST report. The ones partners reach for most often are:

• OWASP ZAP. Free and open source, and the usual starting point for a first submission.
• Burp Suite. The professional edition covers most partner needs, with a stronger active scanner than the free tier.
• Qualys WAS. A hosted option for teams that already run it elsewhere in their stack.
• Other DAST tools such as Veracode, Acunetix, Intruder or JiT DAST are equally acceptable if your team already owns one.

Salesforce cares about the report, not the brand on it. Whatever you run has to show it reached and exercised the live endpoint.

How do you run a scan and document the results?

1. Stand up a full install of the package in a test org with realistic seeded data, so the scanner exercises real workflows rather than empty pages.
2. Authenticate the scanner as a real user, then let it crawl and actively scan every external endpoint the app calls. An unauthenticated scan misses most of the surface.
3. Capture a screenshot or log proving the scan hit the correct endpoint. Salesforce asks for evidence the right target was tested, not just a clean summary.
4. Triage every finding. Fix the real issues, and for each false positive write one entry: tool and rule id, the endpoint, the data path, and the control that protects it.
5. Export the full report plus your false-positive document, and attach both to the submission alongside your static scan reports.

What are the common pitfalls?

• Scanning the wrong target. Pointing the tool at a staging URL the package never calls produces a report Salesforce cannot match to your app.
• Skipping authentication. An unauthenticated scan never reaches the logged-in surface, so the report looks clean because it tested almost nothing.
• Submitting raw output. A dump of findings with no triage reads as unreviewed. Every item needs a fix or a written justification.
• Leaving it until the week before. Run the scan during development so findings surface while they are still cheap to fix.

Where Tekunda fits

Running and evidencing a dynamic scan is exactly the step that stalls a launch when a team meets it for the first time. Tekunda builds and packages AppExchange products as a Salesforce PDO, dynamic scan and submission included.

FAQ

Do I still need a dynamic scan after Chimera retired?

Yes, more than before. Chimera used to run it for you; now you run it yourself and submit the report with your package.

Which tool should I use?

Any credible DAST tool. OWASP ZAP is the free default; Burp Suite, Qualys and Veracode are common paid options. Salesforce judges the report, not the brand.

What if my package has no external endpoints?

Then there may be nothing to scan dynamically. As soon as the app calls a service you operate, that service is in scope and needs its own report.

When should I run the scan?

During development, not the week before you submit, so findings surface while they are still cheap to remediate.