5 Must-Know Tools for Salesforce ISVs to Ace AppExchange Security Reviews
Updated on: Jul 22, 2026
Building secure solutions on the Salesforce platform is crucial for Independent Software Vendors (ISVs) and developers. An unsecured product can face rejection during the security review process or lead to significant issues if not addressed properly. With numerous security and vulnerability tools available, choosing the right one can be challenging.
In our latest podcast, Abhinav, a Salesforce expert and founder of Concret.io, and Harting Harris, a founding member of Concret.io and a seasoned Salesforce architect, discussed five essential tools for the Salesforce security review process. This blog summarizes their discussion, providing a comprehensive guide to help ISVs choose the right tool for their security needs.
Best Tools for Salesforce Security and Vulnerability Checks
# 1. Checkmarx
Checkmarx is a tool used for application security and vulnerability checks, specifically designed to scan Salesforce native code such as Apex, Visualforce (VF), Lightning Web Components (LWC), and triggers. It is one of the oldest and most mature tools used in the Salesforce ecosystem for security review.
Use Case:
Ideal for applications with native Salesforce codes.
Checkmarx scan reports are mandatory for Salesforce security review submissions if your solution includes any native code like Apex, VF, or LWC components.
Quick points:
Installations: Requires submission through the partner security portal.
CI/CD compatible: The paid version supports CI/CD, allowing ISVs to integrate it into their CLI, while the free version does not.
Cost: Free for Salesforce ISV providers with limits; paid versions are available for extended use.
Scan Limits: Checkmarx is limited to 3 scans per review, with a maximum of 2 million lines of code for ISVs and 360,000 lines of code for Salesforce customers.
Extended Use: To scan unpackaged code or exceed the three-scan limit, a Checkmarx license must be purchased.
# 2. Salesforce Code Analyzer
Salesforce Code Analyzer is a more advanced tool provided by Salesforce, designed to support various code types, including Apex, Visualforce (VF), JavaScript, Lightning Web Components (LWC), and TypeScript. This versatile tool ensures both security and code quality.
Use Case:
Code Analyzer is more suitable for frequent and comprehensive scans of native Salesforce codes and beyond.
This tool is Ideal for maintaining both security and code quality standards.
Quick points:
Compatibility: CI/CD compatible CLI-based tool that can be installed locally.
Installation: Not hosted on partner security portal and requires local installation.
Technology Integration: Combines ESLint, JavaScript PMD, RetireJS, Salesforce Graph Engine, and more to provide extensive scanning capabilities.
Real-Time Development Support: Seamlessly integrates with Integrated Development Environment (IDE) for real-time code analysis and development assistance.
Unlimited Scans: There is no limit on the number of scans, making it ideal for regular quality checks.
Accepted and Recommended by Salesforce: The security review team accepts results from Code Analyzer and recommends using it on top of Checkmarx.
# 3. OWASP ZAP
OWASP ZAP (Zed Attack Proxy) is a free and open-source tool primarily used for scanning external API integrations to ensure they are free from vulnerabilities. Unlike other tools, OWASP ZAP does not have a direct tie-up with Salesforce.
Use Case:
ZAP is best for checking external API endpoints, particularly those not controlled by the organization, to ensure they are free from vulnerabilities.
Quick points:
Cost: Free and open-source.
Installation: Not hosted on the partner portal; installable as a desktop application or browser extension.
Compatibility: Works well with CI/CD and QA automated testing tools like Selenium.
Functionality: Ensures comprehensive security checks for external API integrations.
Request and Response Monitoring: Shows all requests made and responses received, including AJAX calls.
# 4. Burp Suite
Developed by Portswigger, Burp Suite is a security testing app, similar to OWASP ZAP. Burp is used for external API endpoint scans and web app vulnerability checks. However, its free version has fewer capabilities, making the paid version a better option for comprehensive scans.
Use Case:
The paid version is more suitable for complex API integrations requiring detailed vulnerability checks
Supports automated vulnerability scanning and testing using specialized tools like Intruder and Sniper, available in the paid version.
Quick points:
Cost: Offers both free and paid versions.
Hosting: Not hosted on the partner security portal and requires installation
Results Accepted with Submission: The security review team accepts results from Burp Suite.
CI/CD Compatibility: The free version is not CI/CD compatible, while the paid version supports CI/CD integration.
# 5. Chimera
Chimera is a cloud-based security scanning tool used for scanning owned servers and endpoints, ensuring they meet Salesforce's security standards. Unlike OWASP ZAP and Burp Suite, which are ideal for scanning external systems not owned by you, Chimera is best suited for endpoints you own.
Use Case:
Chimera is best for organizations that maintain their own servers and API endpoints, ensuring they meet Salesforce's security standards.
Quick points:
Cost: Free and open-source tool with a tie-up with Salesforce.
Hosting: Requires initiation through the partner portal.
Authentication: Scans are performed from a Salesforce IP address, necessitating token-based authentication from the server.
CI/CD: This tool does not support CI/CD integration.
Scan Limitations: It cannot be used with endpoints on domains you don’t own; it requires token upload to the root of the external server.
The Modern Standard: Salesforce Code Analyzer CLI
Developers should no longer run static code scanners in isolated silos. The current standard for pre-review validation centers around the unified Salesforce Code Analyzer CLI (via sf scanner).
Rather than manually stitching together separate reports from PMD, ESLint, RetireJS, and Salesforce Graph Engine, the CLI consolidates all engine results into a single programmatic execution pass. Utilizing the Graph Engine rule definitions is especially vital for flagging complex multi-tier Apex data flow vulnerabilities—such as CRUD/FLS violations, cross-object SOQL injection vectors, and unhandled sharing settings—before submitting your source code to the AppExchange Partner Portal.
Tips from Harting
In the podcast, Harting shared some insightful tips for effectively using these tools:
Regular Scans with Code Analyzer:
Use Salesforce Code Analyzer for each release or deliverable. Frequent scans help in identifying and fixing issues early, reducing the burden on Checkmarx scans.
Final Check with Checkmarx:
After completing the development process, use Checkmarx for a final security review. It acts as a checkpoint to ensure no major vulnerabilities are left unchecked.
Initial API Checks with Chimera:
For owned endpoints, use Chimera as soon as you identify the need for integration. Early scans help in catching issues that might affect the entire application.
Use OWASP ZAP for External APIs:
For external API integrations, OWASP ZAP is a reliable and free tool. It helps in ensuring that external dependencies do not introduce vulnerabilities.
Consider Burp Suite for Complex Integrations:
If dealing with complex API integrations, consider using the paid version of Burp Suite. Its advanced features provide a more thorough vulnerability assessment.
The tools mentioned above are used to check for vulnerabilities in your solution, but none guarantee that all occurrences will be caught. Once you receive the report, it is crucial to manually check all the occurrences in the code to ensure comprehensive security. This manual review complements the automated scans, providing a more thorough evaluation of potential vulnerabilities.
The 2026 Security Frontier: Auditing AI Agents & Data Spaces
AppExchange security reviews have evolved beyond basic web app vulnerabilities (XSS, CSRF, and SQLi). If your managed package or app extension integrates with Data Cloud or Agentforce, the Salesforce Security Review team will rigorously audit your dynamic access parameters:
Prompt Template Guardrails: Ensure your application's dynamic prompt configurations enforce strict context boundaries, preventing prompt injection attacks or unexpected data leaks across tenant boundaries.
Object & Field Level Security (FLS) Enforcements: AI actions executing via Apex or Flow triggers must explicitly enforce user-context permissions (e.g., using WITH USER_MODE or Security.stripInaccessible()). Autonomous agents must never bypass sharing rules to expose restricted enterprise data fields.
Third-Party API Endpoint Auditing: Webhooks and outbound HTTP callouts initiated by AI components must be strictly authenticated via Named Credentials and audited using web vulnerability scanners like OWASP ZAP or Burp Suite.
Fast-Tracking Review Approval: Self-Testing vs. Partner Audits
Failing an AppExchange Security Review delays your commercial go-to-market timeline by months and incurs re-review fees. To minimize risk, software vendors typically follow a two-tier validation approach:
Automated Internal CI/CD Pipeline: Integrate Checkmarx Code Central, PMD, and OWASP ZAP automated suites directly into your GitHub Actions or Bitbucket pipelines. Every code commit should run a automated scan pass to catch security flaws early in development.
Pre-Review ISV Consulting Services: Partnering with specialized AppExchange product development services provides your development team with a full dry-run security audit. Experienced ISV architects review your false-positive documentation, audit cross-site scripting (XSS) vectors, and assist in drafting your mandatory Source Code Analysis (SCA) False Positive Report to guarantee a seamless first-pass approval.
Conclusion
Building a secure Salesforce app requires the right tools and practices. By leveraging Checkmarx, Salesforce Code Analyzer, OWASP ZAP, Burp Suite, and Chimera, ISVs can ensure their applications meet the highest security standards. Regular scans, understanding tool limitations, and integrating security checks into the development process are crucial to achieving a successful security review.
At Concretio, our AppExchange experts specialize in helping ISVs navigate the Salesforce security review process, ensuring that your applications are robust and compliant with industry standards. Partner with us to optimize your security practices and achieve a successful review.
Frequently Asked Questions (FAQ)
Q-1. What are the mandatory tools required to pass the Salesforce AppExchange Security Review?
Ans: While Salesforce does not mandate one specific tool, partners are required to submit clean scan results from official partner scanner tools. For source code, this typically means running the Salesforce Code Analyzer or Checkmarx. For web apps or external endpoints linked to your package, you must supply vulnerability scan logs from tools like OWASP ZAP or Burp Suite.
Q-2. How long does the AppExchange Security Review process take?
Ans: The review process generally takes between 4 to 8 weeks from the date of final submission. However, if security engineers discover critical vulnerabilities (such as bypassable FLS logic or unencrypted token storage), your app will fail the review, requiring code fixes and a re-submission cycle.
Q-3. What is a False Positive Report, and why is it necessary?
Ans: Automated scanners routinely flag safe code patterns as potential threats (e.g., flagging custom string sanitization logic as an unescaped XSS risk). A False Positive Report is a formal technical document drafted by your engineering team explaining line-by-line why specific flagged code instances do not pose an actual security vulnerability.
Q-4. How often do managed packages need to undergo a security review?
Ans: Once approved, your package typically undergoes a complete security review on a periodic or annual basis. Additionally, significant architectural changes—such as introducing major new API integrations, altering core data models, or adding external web services—may trigger an automatic re-review request from Salesforce.
References
Related Salesforce AppExchange Readings
Cost Questions Answered: Salesforce AppExchange Security Review Fees FAQs
Mastering the AppExchange Security Review: Your Strategic Guide to Approval
Continue Learning about AppExchange…
