Skip to main content

Do not pay $999 to fail.

The Salesforce AppExchange Security Review costs $999 per submission attempt. Roughly half of first-time submissions fail and round-trip through 2 to 3 weeks of vendor feedback per revision. sfdx-scanner is mandatory but it only runs PMD, ESLint, RetireJS, and a Salesforce Graph engine. It does not perform CRUD/FLS taint analysis, it does not flag named-credential misconfiguration, and it does not produce a checklist-aligned report you can read like an auditor.

Vulkro does. Offline, on your laptop, before you click submit.

What the AppExchange Security Review actually checks​

The published checklist has 10 sections. The big ones:

  1. Object and field permissions (CRUD/FLS): every DML and SOQL call must have an isAccessible / isCreateable / isUpdateable / isDeletable check (or WITH SECURITY_ENFORCED, or Schema.stripInaccessible, or as user, or fflib_SecurityUtils, or CanTheUser). Missing or partial enforcement is the single most common failure reason.
  2. Sharing model: without sharing on classes that handle record data without an explicit ownership check is a hard fail.
  3. External integrations: hardcoded passwords in named credentials, missing IP restrictions, OAuth scopes broader than the integration actually needs.
  4. Sensitive data storage: secrets in custom settings, custom metadata types, or Protected Custom Settings that turn out not to be protected when you look at the profile that owns them.
  5. Lightning Component (LWC + Aura): lwc:dom="manual" plus innerHTML, unsanitized @wire returns, secrets written to localStorage or sessionStorage.
  6. Visualforce: escape="false" paired with a reflected merge field; <apex:includeScript> with a dynamic URL.
  7. Flow: runInMode = SystemModeWithoutSharing, hardcoded org IDs in <stringValue> elements, DML inside system-context Flows.
  8. Profiles + permission sets: View All Data, Modify All Data, Customize Application, Author Apex granted to non-admin profiles.
  9. Connected apps: Full OAuth scope when a narrower scope would do.
  10. Code quality: PMD-level issues plus deeper interprocedural findings.

Vulkro's Salesforce detectors cover all 10. The vulkro sf-appexchange-report subcommand renders an HTML report grouped by these exact 10 sections, pinned to the checklist version on the day you ran it, so you can hand it to your reviewer (or your own team) and walk the list before paying $999.

What sfdx-scanner misses​

sfdx-scanner is the floor. Vulkro is the prep layer above it.

Issue classsfdx-scannerVulkro
Hardcoded secrets in Apex literalspartial (regex on a few patterns)yes, with provider-key family detection
SOQL injection (single-line concat)yesyes
SOQL injection (multi-line concat across method boundaries)noyes (cross-class taint)
without sharing auditnoyes (severity tracks sharing mode)
Insecure deserializationnoyes
Callout credentials in codenoyes
CRUD/FLS posture per method (request-reachable, DML reach, enforcement reach)noyes (intra-class + cross-class call graph)
IDOR / BOLA (caller-controlled record Id, no ownership check)noyes
Mass-assignment (JSON.deserialize of caller input into SObject)noyes
Open redirect (PageReference from request param)noyes
Visualforce escape="false" reflected merge fieldpartialyes, with $Resource / $Label / JSENCODE wrapping suppression
LWC lwc:dom="manual" + innerHTMLnoyes
Flow runInMode system contextnoyes
Named credential hardcoded passwordsnoyes
Connected app Full scopenoyes
Profile over-privilege (View All / Modify All)noyes
Checklist-aligned HTML reportnoyes (10 sections, pinned to the published checklist)

Detector packs for the full Salesforce surface​

Vulkro covers the full Salesforce surface, not just core Apex. Each pack self-activates when its markers are present in your sfdx-project.json repo, so a managed package that only touches Apex + LWC never pays the walk cost on the B2C Commerce or Heroku Connect paths.

PackWhat it coversDoc
PMD-for-ApexIndustry-standard Apex linter with a Vulkro-curated security-only ruleset. Replacement for the sfdx-scanner Apex pack.scan-with-pmd
ESLint LWC rulesetLightning Web Components linting with the LWC-specific rules enabled.scan-with-eslint
RetireJSCVE-bearing JS in staticresources/, vendored LWC, and Aura.scan-with-retirejs
B2C Commerce CloudCartridge + SFRA storefront security rules.sf-b2c-commerce
Marketing CloudAMPscript injection, SSJS, SQL Query Activity, Cloud Pages, REST customisations.sf-marketing-cloud
Industries CloudsHealth Cloud and Financial Services Cloud, including PHI cross-component leakage.sf-industries-clouds
CRM AnalyticsSAQL injection, dashboard binding to tainted free-text input, row-level security on PII datasets, hardcoded SF IDs.sf-crm-analytics
Salesforce FunctionsNode + Java runtime context credential leakage, payload validation gap, outbound rate limiting, infinite-loop budget burn.sf-functions
Heroku ConnectMapping config, Postgres bridge without pgcrypto, write-back conflict policy, plaintext PG URL, hardcoded REST API token.sf-heroku-connect

How the cycle works​

  1. Build your managed package in your sfdx-project.json repo.
  2. Run vulkro sf-appexchange-report force-app -o readiness.html.
  3. Open the HTML report. Walk the 10 sections. Fix what's flagged.
  4. Re-run. When the report says READY, submit to Salesforce.
  5. If Salesforce flags something new, re-run Vulkro with the reviewer's notes in hand to find similar patterns elsewhere in the codebase.

The whole loop runs on your laptop. Nothing about your unreleased managed package leaves your machine.

Get it for your submission​

Vulkro for Salesforce is sold by conversation. Email [email protected] with your app name, planned submission date, and which Salesforce DX path your repo lives at. We reply within one business day.

Why offline matters here​

Your unreleased managed package is, by definition, code that nobody outside your team has seen yet. Sending it to a SaaS scanner means it leaves your machine, gets indexed in a vendor database, and a copy lives at rest somewhere you do not control. For an ISV preparing a competitive product, that is exactly the wrong shape of data leak.

Vulkro runs entirely on your laptop. No telemetry, no upload, no cloud LLM, no account. The detection engine and the CVE bundle both live in the binary. Air-gap with VULKRO_OFFLINE=1 to enforce zero network at the process boundary.

The credibility play​

We do not ask you to trust the marketing. The benchmark harness is reproducible: clone the corpus, run the same commands, get the same numbers. The per-rule documentation explains every detector with positive and negative code examples. The Salesforce coverage docs list every rule that maps into each checklist section. The Salesforce methodology is the master reference: Well-Architected pillars, AppExchange Top-20, the 2025-26 breach class map, and Vulkro's detector-by-detector coverage matrix - every row labeled Covered or explicitly Out-of-Scope.

Ready to start?​

Email [email protected]

Reply with your app name, planned submission date, and one sentence about the app. We reply within one business day.