Skip to main content

The AppExchange Security Review process (now AgentExchange)

Every managed package listed on AgentExchange (formerly AppExchange) must pass Salesforce's Security Review, run by the Product Security team, before it can be listed. To prepare section by section, use the AppExchange Security Review checklist.

vulkro-sf appexchange-report ./my-package -o report.html

When it applies​

  • A first submission of a new managed package.
  • Significant changes to a listed package (new components, permission sets or external callouts).
  • A resubmission after a failed review.

What it costs​

  • Fee: Salesforce charges a fee for each review attempt (see its current partner pricing). A failed attempt is not refunded.
  • Time: Salesforce says a review typically takes four to five weeks. Each fix and resubmission is another attempt.
  • Failure rate: roughly half of first submissions fail, by industry estimate. The most common cause is missing CRUD/FLS enforcement, which Salesforce ranks first in its Top 20 vulnerabilities.

What the reviewer runs​

  1. The platform's own code analyzer over the package (Apex rules, JavaScript linting, vulnerable-library checks and a flow-sensitive engine). A package that fails it is rejected before manual review.
  2. An enterprise static analysis tool for further taint analysis.
  3. A manual review against the Security Requirements Checklist.

The checklist has eight code categories: authentication and sessions, authorization (CRUD / FLS / sharing), input validation, output encoding, cryptography, communication security, logging and error handling, and secrets storage. Reviewers also check every external endpoint and Connected App scope, the permissions the package grants, sensitive data handling, component security, and your vulnerability disclosure process.

Where Vulkro fits​

Passing the platform code analyzer is required, and Vulkro does not replace it. Vulkro adds:

  • Metadata posture the code analyzer does not check: security settings, sharing, profile and permission set over-privilege, Connected App scopes, Named Credentials.
  • Agentforce and breach-class checks: agent actions on without sharing classes, and the preconditions of the 2025-26 breaches.
  • The readiness report: findings mapped to the checklist with PASS / FAIL / NOT EVALUATED per section, and the submission packet with drafted false-positive justifications for the code analyzer's rows (--import-code-analyzer).

Recommended order: run the code analyzer and fix what it reports, then run vulkro-sf scan and vulkro-sf appexchange-report to close the remaining gaps and produce the report.

See also: AgentExchange readiness report, Readiness audit, Top-20 coverage

Last updated on