Salesforce Developers published the top 20 most-flagged vulnerabilities in August 2023. The first three: CRUD/FLS, outdated libraries, sharing violations. Most checklists on the SERP cover the same items in a different order, but the ranking from Salesforce itself is the one that decides if you pass.
TL;DR: Pass the Salesforce security review by enforcing CRUD/FLS (the top failure cause), fixing sharing and injection issues, removing hard-coded secrets, requiring TLS 1.2+, and running Code Analyzer before you submit (Salesforce Developers). Complete documentation and test credentials are required too.
The checklist
Work through these before you submit. They map directly to what the review actually tests.
Access control
WITH SECURITY_ENFORCED, stripInaccessible(), or explicit checks)with sharing to Apex classes that should respect sharing rulesInput and output
Secrets and transport
Dependencies and testing
Submission package
Start with CRUD/FLS. It's the single most common rejection by a wide margin. Verifying object- and field-level enforcement everywhere clears the biggest risk before you touch anything else.
How to prepare
Treat security as part of building, not a final step. Run Code Analyzer early and often so issues surface while they're cheap to fix, not after a four-week review. Document your data flows and external integrations, prepare a clean test org with sample data and credentials, and write short justifications for any scanner findings you believe are false positives. Submitting a complete, well-documented package speeds the manual review.
Why code built to a fixed standard passes more easily
The checklist is long. Every item is a chance for a hand-coded app to slip. Code built to a fixed standard applies the access-control, sharing, and injection-safety rules uniformly across every component, so the most common failures are designed out. Appnigma's engineers build managed-package code against these requirements, which is how teams without Salesforce developers clear a review built around developer-grade secure coding. See building a managed package without a Salesforce developer.
Frequently Asked Questions
How do I prepare my Salesforce app for the security review?
Enforce CRUD/FLS, add with sharing, sanitize inputs, remove hard-coded secrets, require TLS 1.2+, update libraries, keep 75%+ test coverage, run Code Analyzer, and prepare complete docs with test credentials (Salesforce Developers).
What is the most common reason apps fail the security review?
Missing CRUD/FLS enforcement, which Salesforce names as the top failure cause by a significant margin. Verifying object- and field-level permission checks everywhere is the highest-impact preparation step.
What documentation does the security review require?
Architecture and data-flow documentation, a configured test environment with credentials, and your scan results with justification for any false positives. Complete documentation speeds the manual portion of the review.
Can done-for-you apps pass the security review?
Yes. The review tests the package, not who authored it. Generated code that enforces CRUD/FLS, sharing, and injection safety by default passes the same review. That's how non-developers list apps.
Key takeaway
To pass the Salesforce security review, enforce CRUD/FLS (the top failure cause), add with sharing, sanitize inputs against SOQL injection and XSS, remove hard-coded secrets, require TLS 1.2+, run Code Analyzer, and submit complete docs with test credentials. Appnigma AI builds managed-package code against these requirements to head off the common failures.
About the author. Sunny Chauhan is the co-founder and CEO of Appnigma AI, which builds and maintains customer integrations and native Salesforce and HubSpot apps for B2B SaaS teams. Before Appnigma, he was on Salesforce's AppExchange team, where he worked with more than 300 SaaS partners. He has spent close to a decade on the Salesforce platform, including work at Zennify, and holds Salesforce certifications including Platform Developer II, Platform App Builder, Administrator, Data Cloud Consultant, and AI Associate.
Related Articles
- What is the Salesforce security review
- What happens if my app fails security review
- How to build a managed package without a Salesforce developer
- Salesforce security review cost and fee
- Salesforce Code Analyzer v5: engines and commands
Sources
- Salesforce Developers, Top 20 Vulnerabilities in the AppExchange Security Review, 2023
- Salesforce Developers, Prepare Your App to Pass the AppExchange Security Review, 2023
- Salesforce ISVforce Guide, security requirements
Which item on the checklist did your last review catch you on?
