AppExchange Top-20 vulnerabilities (Vulkro coverage)

Salesforce Dev Relations publishes the empirical ranking of the Top 20 vulnerabilities found in the AppExchange Security Review, ordered by real-world submission failure rate. This page maps every entry to the Vulkro detector that catches it.

The order below is the canonical Salesforce ordering: failures #1 (most common) through #20 (least common, still material).

1. CRUD / FLS enforcement

Failure to check object and field-level accessibility before a query or DML. Catches the entire class of "the controller queried a sensitive object the user does not have read access to."

Detector: detectors/apex. The CRUD / FLS enforcement rule (apex_crud_fls) flags missing WITH USER_MODE / WITH SECURITY_ENFORCED, missing isAccessible() / isCreateable() checks, and DML calls that omit AccessLevel.USER_MODE.

2. SOQL injection

Untrusted input concatenated into a dynamic SOQL string. Catches the Database.query('... WHERE Name = \'' + name + '\'') shape.

Detector: detectors/apex. The SOQL injection rule flags string concatenation into Database.query / Database.queryWithBinds arguments without String.escapeSingleQuotes and without a bind variable.

3. Sharing violations

Apex class with no sharing declaration (or without sharing) reachable from user input. The class runs in system context and bypasses record-level access.

Detector: detectors/apex. The sharing violation rule flags without sharing on a user-reachable class, and the absence of any sharing keyword on a class that performs DML or SOQL against an sObject containing user-supplied input.

4. Mass assignment via JSON.deserialize

JSON.deserialize(payload, Account.class) lets a caller set fields they should not be able to write (OwnerId, RecordTypeId). Equivalent of Rails mass assignment.

Detector: detectors/apex. The mass-assignment rule flags JSON.deserialize (and JSON.deserializeStrict) into an sObject type without a subsequent Security.stripInaccessible filter.

5. IDOR via record-ID parameter

Controller accepts an Id parameter and queries the record without re-verifying the user can see that ID. Classic insecure-direct-object -reference shape.

Detector: detectors/apex. The IDOR rule flags constructor / @AuraEnabled method arguments of type Id that flow into a SOQL WHERE Id = :param without an accompanying access check.

6. Flow system-context DML

A Flow declared in System Context performs DML on a user-reachable trigger. Bypasses sharing rules and CRUD/FLS.

Detector: detectors/flow. The flow rule parses the .flow-meta.xml file, identifies RunInMode = SystemModeWithSharing / SystemModeWithoutSharing declarations, and flags writes to sensitive standard objects when reachable from a public guest entry point.

7. Visualforce controller CSRF (DML in constructor on GET)

A Visualforce controller performs DML in its constructor, which runs on HTTP GET. An attacker constructs a URL that triggers the DML; the victim's browser sends the request with the victim's session cookie.

Detector: visualforce. The CSRF rule flags DML statements (insert, update, delete, upsert, Database.insert / Database.update / etc.) inside a constructor method of a class bound to a *.page file.

8. Crypto misuse

MD5 or SHA-1 for authentication; static IV; Math.random() for tokens; hardcoded crypto keys.

Detector: detectors/apex. The crypto rule flags Crypto.generateDigest('MD5', ...), 'SHA-1', AES with a static IV (literal bytes in source), Math.random() used as a token source, and hardcoded Blob.valueOf keys passed to Crypto.encrypt.

9. External script include over HTTP

<apex:includeScript value="http://cdn.example.com/foo.js" />. The script bypasses CSP and runs in the page's origin.

Detector: visualforce. The external-include rule flags <apex:includeScript> whose value is a literal URL (not {!$Resource.Foo}) and whose protocol is http:// or https:// (the Top-20 #9 wants StaticResource references, not external CDNs).

10. LWC DOM XSS

lwc:dom="manual" plus direct innerHTML assignment from a @wire-bound value. Or template.innerHTML = userContent. Any path from external data into the DOM without sanitisation.

Detector: detectors/lwc-aura. The LWC DOM-XSS rule traces @wire / @api / @track fields into innerHTML, outerHTML, and insertAdjacentHTML sinks without an intervening DOMPurify call.

11. Aura DOM XSS

aura:unescapedHtml rendered with a user-controlled value, or Component.set('v.html', userData) into an aura:unescapedHtml body. The Aura equivalent of #10.

Detector: detectors/lwc-aura. The Aura DOM-XSS rule flags aura:unescapedHtml attributes whose value expression traces back to a controller call returning user input.

12. PostMessage handler missing origin check

window.addEventListener('message', e => { ... }) with no e.origin check. Any cross-origin frame can post into the handler.

Detector: detectors/lwc-aura. The postMessage rule flags addEventListener('message', ...) callbacks that reference event.data without first comparing event.origin against a literal or known-good list.

13. Stack trace disclosure

Exception.getStackTraceString() returned to a user-facing surface (an @AuraEnabled method response, a Visualforce <apex:outputText>, a REST resource response body).

Detector: visualforce and the Apex URL-safety rule. Any call to Exception.getStackTraceString() is flagged: the API itself is the smell, because stack-trace strings should never reach a user-facing surface.

14. SecuritySettings hardening

The org's SecuritySettings.settings metadata: session timeout, HTTPS required, clickjack protection, CSRF on GET / POST, password policy length / complexity / expiration / lockout. Any of these set to a weak value fails review.

Detector: detectors/security-settings. Ten distinct checks on the SecuritySettings file: each weak setting is its own finding with the exact pillar it violates.

15. LightningMessageChannel isExposed=true

A .messageChannel-meta.xml file with <isExposed>true</>. The channel becomes reachable across packages, including from any LWC the package consumer installs.

Detector: detectors/security-settings. The LMC inventory rule scans every *.messageChannel-meta.xml in the package and flags <isExposed>true</> at Medium severity (admin should confirm the cross-package surface is intended).

16. PageReference / setEndpoint untrusted concatenation

new PageReference(userInput). HttpRequest.setEndpoint(baseUrl + userInput). Any URL construction that concatenates untrusted input. Catches open-redirect and the "credentials in URL query string" smell when the untrusted input is itself a sensitive identifier.

Detector: visualforce. The URL-safety rule flags new PageReference(...) constructors and HttpRequest.setEndpoint(...) calls whose argument is a string-concatenation expression that includes a variable not bound to a Named Credential.

17. Aura action CSRF

Aura @AuraEnabled action invoked from a custom DOM element (not the Aura framework) without the framework-injected CSRF token. Rare but material on custom-rendered components.

Detector: detectors/lwc-aura. The Aura CSRF rule flags $A.enqueueAction patterns that bypass the standard form-level CSRF token, and XmlHttpRequest-style direct posts to Aura endpoints inside .cmp controllers.

18. Hardcoded secrets in Apex / LWC

API keys, OAuth client secrets, AWS access keys, Slack webhooks pasted into Apex string literals, LWC .js, or .resource content. Catches the entire AppExchange "rejected for hardcoded secret" bucket.

Detector: detectors/apex. The secrets rule covers six credential patterns (AWS Access Key + Secret, Slack webhook, GitHub token, generic API-key shape, Bearer token), plus the engine's entropy-based string-literal scan. Visible across .cls, .trigger, .js, and .resource content.

19. System.debug of sensitive variables

System.debug(password). System.debug('OAuth token: ' + accessToken). The debug log is preserved across every transaction and is readable by any user with View All Data; treating it as a public surface is the right mental model.

Detector: Apex logging detector (sf_apex_logging). The rule flags System.debug(...) calls whose argument expression references a variable whose name matches a sensitive-identifier heuristic (password, secret, token, api_key, session_id, etc.).

20. Agentforce class-bypass (ForcedLeak)

A GenAiFunction Apex action whose target class is declared without sharing. The Apex action runs in the agent's runtime user context, so a without sharing class leaks data across users via the agent. Disclosed in 2025 as CVSS 9.4.

Detector: detectors/agentforce. The ForcedLeak rule is a two-pass walk: pass one identifies every GenAiFunction Apex action, pass two opens the referenced .cls file and confirms the source-level sharing keyword. Fires High when the target class is without sharing.

What about #X (the ones not in this list)?

Every Top-20 entry has an explicit Covered / Partial / Out of scope status on the methodology page (section 10.1: "AppExchange Top-20 vulnerability coverage"). The handful of Salesforce entries marked Out of scope (cosmetic Lightning CSS load, Classic-only JavaScript, password-echo runtime checks, username-enumeration DAST-probes) are documented there with the architectural reason.

The full coverage matrix on the methodology page also names the rule ID for every Covered entry, so a finding emitted by vulkro-sf can be traced back to the row that justifies it.