Tekunda Team
Back to Articles
Tekunda Team
Salesforce Security Review Scanner Requirements in 2026
Salesforce changed which scans the security review requires: Code Analyzer moved to version 5, and Salesforce stopped running the dynamic scan for you when Chimera was decommissioned. Here is what you must run in 2026, how the pieces fit, and how to document the results so the review clears on the first submission. For the full pre-submission controls, see our guide to passing the AppExchange security review.
Which scans are required in 2026?
Two automated scans are mandatory, and skipping either is the fastest way to fail:
- Salesforce Code Analyzer is now generally available at version 5, free, and built into the Salesforce CLI. It runs multiple engines and ships with more than 500 rules across Apex, Lightning, Visualforce, and Flow. Version 4 was retired in August 2025, so make sure your pipeline calls v5.
- The Source Code Scanner (Checkmarx) runs through the partner portal and is required in addition to Code Analyzer.
Salesforce also gives you a requirements checklist builder that tailors the scan list to the technologies your package actually uses, so you are not proving controls you never ship.
Who runs the dynamic scan now that Chimera is gone?
You do. If your package calls a service you operate, that service is in scope: run your own dynamic (DAST) scan with an accepted tool such as OWASP ZAP or Burp Suite and attach the report. Salesforce stopped running that scan for you when Chimera was decommissioned in June 2025, so see running your own dynamic scans after Chimera and remove Chimera from your runbook if it is still there.
How do you document the scanner results?
The scanners are the easy part. Packages fail on the human steps around them. The two we see most often:
Undocumented false positives. A scanner flags a line you have already mitigated, you leave it unexplained, and the reviewer treats an unanswered finding as an open risk.
The fix is a short remediation note for every flagged item you did not change, explaining why it is safe. When a scan comes back noisy, our companion piece on what to fix, in order sets the priority. The second trap is treating remediation as a single pass. You scan, fix, and re-scan until the report is clean, then submit the clean report, not the first one. Budget for that loop; a rushed submission with a noisy scan almost always comes back.
Tekunda builds and ships AppExchange packages through this process, so we run these scans before every submission rather than after a rejection. If you want a partner who has passed the review repeatedly, start here.
FAQ
Is Salesforce Code Analyzer enough on its own?
No. Code Analyzer is required, but you must also run the Checkmarx source scanner, and dynamic testing is expected for any external endpoint your package calls.
What replaced the Chimera scanner?
Nothing from Salesforce. Since Chimera was decommissioned in June 2025 you run your own dynamic scan with a tool such as OWASP ZAP or Burp Suite and attach the report.
Which Code Analyzer version does the review require?
Version 5. It is generally available and built into the Salesforce CLI; version 4 was retired in August 2025, so point your pipeline at v5.
