AgentExchange Security Review readiness report
vulkro-sf appexchange-report maps your findings to the AgentExchange (formerly AppExchange) Security Review checklist and writes one self-contained HTML report with PASS, FAIL or NOT EVALUATED per section.
vulkro-sf appexchange-report ./my-package -o report.html
Open the file in a browser; use Save as PDF to attach it to your submission. The path is an SFDX project (sfdx-project.json) or retrieved metadata (package.xml). The report header pins the checklist mapping version, so a report reads the same later.
Options
| Flag | What it does |
|---|---|
--format <fmt> | html (default) is the report; table, json and markdown print the checklist. |
-o, --output <file> | Write to a file instead of stdout. |
--gate | With table, json or markdown: exit 1 when a pre-submit item fails (the CI gate). |
--packet | Add the submission packet: review-blocking findings ordered by fix effort. HTML always has it. |
--import-code-analyzer <file> | Import the platform code analyzer report (JSON, SARIF or CSV) and draft a false-positive justification for each row Vulkro has evidence for. |
--fpw-out <file> | Write the False Positives Whitelist (FPW.json). Drafts are marked draft; read each one before you upload. |
--prepared-for, --prepared-by | Names for the report cover. |
The packet does not replace the code analyzer report the review requires.
What the report contains
- A header with the project, scan time, checklist version and an overall verdict: READY when every section passes, GAPS FOUND otherwise.
- A note listing what static analysis cannot check (penetration testing, live-org configuration, documentation).
- Pass, fail and not-evaluated counts, plus findings that map to no section, so nothing is dropped.
- One row per checklist section with its covering rules and, on FAIL, a table of findings (file, line, severity, rule, message).
It also covers the review categories SF-ASRR-001 to SF-ASRR-006 and the pre-submit checklist SF-PRESUBMIT-001 to SF-PRESUBMIT-010.
Exit codes
| Code | --format html | table / json / markdown |
|---|---|---|
0 | Every section passes | Report produced (no failing item with --gate) |
1 | A section fails, or no licence | A pre-submit item fails with --gate, or no licence |
2 | Error | Error |
The report is a readiness indicator, not a guarantee: Salesforce's reviewers make the final decision, and NOT EVALUATED sections still need manual review.
See also: The review process, AppExchange HTML report, CLI reference