AgentExchange Top-20 vulnerabilities (Vulkro coverage)

Salesforce publishes the Top 20 vulnerabilities found in the AgentExchange (formerly AppExchange) Security Review, ranked by how often submissions fail on them. This page maps each one to the Vulkro check that covers it.

vulkro-sf scan ./my-package
vulkro-sf appexchange-report ./my-package -o report.html

#	Vulnerability	Vulkro coverage
1	CRUD/FLS enforcement	Covered: queries and DML without `USER_MODE`, `WITH SECURITY_ENFORCED` or access checks (Apex)
2	Insecure software version	Covered for JavaScript: vulnerable libraries in static resources, LWC and Aura (SCA). Apex has no package manager.
3	Sharing violation	Covered: `without sharing` or no sharing keyword on reachable classes; agent actions on such classes (Apex, Agentforce)
4	Insecure storage of sensitive data	Covered: secrets in Apex, LWC, static resources and metadata (Connected Apps, Named Credentials)
5	TLS/SSL configuration	Covered: TLS checks
6	Sensitive information in debug	Covered: `System.debug` of password, token, key or session values
7	CSRF	Covered: CSRF protection off in `SecuritySettings`; DML in a Visualforce controller constructor
8	Stored and reflected XSS	Covered: Visualforce and LWC and Aura
9	JavaScript not in static resources	Covered: `<apex:includeScript>` from an external URL
10	SOQL injection	Covered: untrusted input in dynamic SOQL without binding or escaping
11	Lightning: improper CSS load	Out of scope (cosmetic)
12	JavaScript in Salesforce DOM (Classic)	Out of scope (Classic only)
13	Information disclosure on errors	Covered: `Exception.getStackTraceString()`
14	Aura: CSS outside component	Out of scope (cosmetic)
15	Message channel exposed	Covered: `<isExposed>true</isExposed>` on a Lightning Message Channel
16	Sensitive info in URL	Covered: tokens, passwords or keys concatenated into `PageReference` or callout URLs
17	Insecure endpoint	Covered: `http://` remote sites, Named Credentials and callouts
18	Username or email enumeration	Out of scope (needs dynamic testing)
19	Password management	Covered: password policy in `SecuritySettings`. Runtime behaviour needs dynamic testing.
20	Password echo	Out of scope (needs dynamic testing)

15 covered, 5 out of scope. The methodology explains how coverage is recorded.

Also checked, beyond the Top 20

Mass assignment: JSON.deserialize into an SObject without Security.stripInaccessible.
Record access by ID without an access check (IDOR).
Flows that run DML in system mode.
Agentforce actions on without sharing classes (the ForcedLeak class). See the breach class map.

Also checked, beyond the Top 20​

Also checked, beyond the Top 20