iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Salesforce’s AppExchange security review assesses whether a managed package and its associated app are secure enough to list. It combines automated code checks and submission checks with deeper review by security specialists. A passing scan helps identify issues, but it does not guarantee approval: reviewers may find vulnerabilities through manual testing that automated tools miss.
What the review examines
The review is not limited to whether the package compiles or whether a static scan is clean. Salesforce’s preparation guidance describes a multi-layer process in which the package, its behavior, and its supporting services may all matter. The relevant risks depend on the package’s architecture, data flows, integrations, and implementation.
Authorization and data access
Review how the app enforces object-level permissions (CRUD), field-level security (FLS), and record sharing. In Apex, examine execution mode and sharing behavior explicitly; do not assume the caller’s permissions are automatically enforced in every context. Reviewers may try to access protected data using the user type supplied for testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Lightning and browser security
Check that Lightning components work within Lightning Locker and Content Security Policy (CSP) restrictions. External resources generally need to be hosted in the org or explicitly allowed through CSP Trusted Sites, and external resource references should use HTTPS.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Integrations and external endpoints
Inventory the services the package contacts and assess their security, not just the Salesforce-side code. Use HTTPS, review TLS configuration, and ensure production endpoints do not reveal debug details or stack traces. Confirm that external app access provided for review works as expected.
Injection and unsafe input
Trace user-controlled input through SOQL construction and other dynamic behavior. Look for injection risks and unsafe handling of input, including paths that may not be obvious from the user interface.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Secrets, personal data, and information leakage
Do not hard-code credentials or expose passwords, keys, tokens, personal data, or detailed stack traces in logs or responses. Avoid putting long-term secrets in URLs. Review both normal responses and error paths for information that should remain private.
Dependencies and package-specific patterns
Patch vulnerable dependencies and review package-specific concerns such as session ID access, HTTP Remote Site Settings, and insecure API versions. The package’s configuration and dependencies are part of the security picture, even when the risky behavior is not in the main application code.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
What the automated scan does—and does not—tell you
Salesforce Code Analyzer provides automated checks for code patterns, but Salesforce cautions that initial scans offer a high-level assessment and cannot find every vulnerability a manual review may uncover. A clean report is useful evidence, not a certification that the app is secure or certain to pass.
Salesforce’s current documentation describes Code Analyzer v5, distributed through the Salesforce CLI plugin @salesforce/plugin-code-analyzer. Version 4 was retired in August 2025. Because the analyzer releases monthly and rule references can change, check the current v5 documentation and the installed plugin’s help rather than copying older scanner-era instructions.
Rank #4
![FIDO2 Security Key [Folding Design] Thetis Universal Two Factor Authentication USB (Type A) for Multi-Layered Protection (HOTP) in Windows/Linux/Mac OS,Gmail,Facebook,Dropbox,SalesForce,GitHub](https://m.media-amazon.com/images/I/319b82vXgEL._SL160_.jpg)
- Passwordless World - A revolutionary new way to protect your account info. By being FIDO2 certified by the world’s largest ecosystem for standard-based, interoperable authentication, FIDO2 makes everyday log-in experience effortless and passwordless yet more secure than generic password style security. **Note: FIDO2 does NOT support Mac log-in.
- Online Account Protection - FIDO2 key is backward compatible with U2F protocol and works with the newest Chrome browser with operating systems such as: Windows, macOS, or Linux. U2F can be supported and protected on all websites that follow U2F protocols.
- Multi-factored Authentication - Built-in, advanced HOTP (One Time Password) technology that completes the unique multi-factored authentication process. Eliminate worry and help prevent losing your account info to theft, phishing, hacking, or other online scams. Note: Only Enterprise Users using Azure Active Directory can access Windows Hello log-in via Thetis FIDO2 Security Key.
- Compact And Durable - 360° design with rotating aluminum alloy cover that shields the USB connector when not in use. Tough and durable alloy protects FIDO2 key from daily wear-and-tear, accidental drops, and scratches.
- Portable Design - ultra-portable design allows you to take your FIDO key anywhere you need it.
How to prepare and submit scan reports
- Install or update the current analyzer. Use Salesforce CLI with the
@salesforce/plugin-code-analyzerplugin and verify that you are using v5, not retired v4. - Run the AppExchange and security rule sets. Salesforce’s review instructions specify the selectors
AppExchangeandRecommended:Security, with an HTML report generated using--output-file. A command following that documented pattern issf code-analyzer run --rule-selector AppExchange --rule-selector Recommended:Security --output-file code-analyzer-report.html. Confirm the exact syntax against the help for the installed plugin version. - Triage findings. Fix violations that can be fixed. Investigate potential false positives and exceptions, and be ready to explain them. Salesforce says scans do not have to be 100% passing to submit.
- Rerun and attach the reports. After remediation, rerun the scans and attach the resulting report to the Security Review Wizard submission.
- Prepare a reviewable package and test environment. Select the correct managed package and version, include relevant dependencies, explain package relationships, and provide working access to the test org or external app. Use representative test credentials and make sure the supplied user type can exercise the intended functionality.
Why a package can pass an initial scan but not deeper review
Automated analysis and human review have different coverage. A scan can flag known code patterns without exercising every role, data flow, endpoint, or runtime condition. A deeper assessment can test how the app behaves with the supplied user, whether sensitive data is protected in practice, and whether an external service or configuration creates a weakness that a static check did not detect.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor that reason, use Code Analyzer as one layer in a continuing security process. Pair it with threat modeling, manual code and application testing, and security-team input; keep scanning and testing as the product changes. Salesforce guidance also identifies partner security tools and testing with tools such as ZAP or Burp as complementary options, not substitutes for judgment or guarantees of approval.
Quick Recap
Submission-readiness checklist
- Run the current Code Analyzer v5 with the AppExchange and Recommended:Security selectors.
- Review access control, sharing, injection paths, secrets, data exposure, dependencies, TLS, and external services in the context of the app’s design.
- Fix actionable scan findings, document understood exceptions, rerun scans, and include the reports.
- Provide the intended package version, relevant dependencies, package relationship details, and working test access.
- Plan for runtime and manual security testing in addition to automated scanning.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
