Salesforce’s AppExchange security review assesses whether a managed package and its associated app are secure enough to list—not simply whether the code passes an automated scan. It combines automated checks with review by security specialists, so preparation should include code analysis, security testing, and a submission that reviewers can access and evaluate.
What the AppExchange security review examines
Salesforce describes the review as a multi-layer process. Automated checks provide an initial assessment, but they cannot identify every vulnerability that a deeper review may uncover. The exact risks depend on the package’s architecture, data flows, dependencies, and integrations; the areas below are recurring examples, not a complete or universal checklist. Salesforce’s preparation guidance explains common review concerns.
As an Amazon Associate I earn from qualifying purchases.
Authorization and data access
Review whether the app enforces object-level permissions (CRUD), field-level security (FLS), and the intended record-sharing behavior. In Apex, examine execution mode and sharing declarations rather than assuming that the caller’s permissions are always enforced.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Lightning and browser protections
Account for Lightning Locker and Content Security Policy (CSP) restrictions. External resources generally must be hosted in the org or allowed through CSP Trusted Sites, and references to external resources should use HTTPS.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Integrations, input handling, and information exposure
- Use HTTPS for external endpoints and review every service the package calls. Production services should not reveal debugging details or stack traces.
- Inspect SOQL construction and other paths that use user-controlled input for injection risks and unsafe dynamic behavior.
- Keep credentials and other long-term secrets out of source code and URLs. Do not expose personal data, passwords, keys, tokens, or detailed stack traces in logs or responses.
Dependencies and configuration
Check dependencies for known vulnerabilities, review TLS configuration, and investigate package-specific patterns such as session ID access, HTTP remote site settings, and insecure API versions.
Test behavior and access
Reviewers need to test the application, including attempts to access protected data using the user type supplied for testing. Working test-org access and representative credentials therefore matter: a secure design is difficult to assess if the submitted environment or account cannot demonstrate it.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How to prepare the scan reports
Use the current Salesforce Code Analyzer CLI guidance, not obsolete instructions from the earlier scanner tooling. Salesforce’s documentation describes Code Analyzer v5 and the Salesforce CLI plugin @salesforce/plugin-code-analyzer; Code Analyzer v4 was retired in August 2025. Because releases and rule references can change, check the current Code Analyzer documentation when preparing a submission.
- Run Code Analyzer v5. Install and use the current Salesforce CLI plugin according to Salesforce’s documentation.
- Select the review rules and create an HTML report. Salesforce’s AppExchange review instructions specify the AppExchange and Recommended:Security selectors, with an output file for the report. For example, the documented options are
--rule-selector AppExchange --rule-selector Recommended:Security --output-file report.html; use the command syntax supported by the installed CLI version. - Triage findings. Fix issues that can be fixed. Investigate and document false positives or exceptions rather than treating them as resolved by default.
- Rerun the scans and submit the reports. Attach the resulting report to the Security Review Wizard submission. Salesforce says scans do not have to be 100% passing to submit; that is permission to submit with understood findings, not evidence that unresolved risks are acceptable.
What a scan can—and cannot—tell you
Code Analyzer checks source code against selected rules. It is useful for identifying patterns in the code, but it cannot by itself establish how the running app behaves, whether protected data is reachable through an unexpected path, or whether an external service is secure. Salesforce’s review preparation article warns that an initial scan may pass while deeper review finds issues.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Treat static analysis as one part of a broader security process. The appropriate mix depends on the app, but may include threat modeling, manual code review, runtime application testing, security-team input, and ongoing checks in CI/CD as features evolve. Salesforce’s guidance on keeping AppExchange apps secure discusses ongoing scanning and manual testing. Tools such as ZAP or Burp and partner security tools can add coverage; they complement rather than replace Salesforce’s review or human judgment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the submission testable
Before submitting, confirm that reviewers can identify the package under review and exercise the relevant functionality. Salesforce’s preparation guidance highlights package type and version, dependencies, package relationships, and access to the test org or external app as practical readiness concerns.
Rank #4
![FIDO2 Security Key [Folding Design] Thetis Universal Two Factor Authentication USB (Type A) for Multi-Layered Protection (HOTP) in Windows/Linux/Mac OS,Gmail,Facebook,Dropbox,SalesForce,GitHub](https://m.media-amazon.com/images/I/319b82vXgEL._SL160_.jpg)
- Passwordless World - A revolutionary new way to protect your account info. By being FIDO2 certified by the world’s largest ecosystem for standard-based, interoperable authentication, FIDO2 makes everyday log-in experience effortless and passwordless yet more secure than generic password style security. **Note: FIDO2 does NOT support Mac log-in.
- Online Account Protection - FIDO2 key is backward compatible with U2F protocol and works with the newest Chrome browser with operating systems such as: Windows, macOS, or Linux. U2F can be supported and protected on all websites that follow U2F protocols.
- Multi-factored Authentication - Built-in, advanced HOTP (One Time Password) technology that completes the unique multi-factored authentication process. Eliminate worry and help prevent losing your account info to theft, phishing, hacking, or other online scams. Note: Only Enterprise Users using Azure Active Directory can access Windows Hello log-in via Thetis FIDO2 Security Key.
- Compact And Durable - 360° design with rotating aluminum alloy cover that shields the USB connector when not in use. Tough and durable alloy protects FIDO2 key from daily wear-and-tear, accidental drops, and scratches.
- Portable Design - ultra-portable design allows you to take your FIDO key anywhere you need it.
- Include the correct managed package and relevant dependencies, and explain how the packages relate.
- Verify that the package version selected for review is the intended one.
- Provide working test-org or external-app access and representative credentials.
- Ensure test access can demonstrate expected permissions and attempts to reach protected data.
Submission instructions, fees, and review queue estimates can change. Check the current Salesforce Partner Community guidance for those operational details rather than relying on historical figures.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
