AgentExchange Security Review readiness

The readiness audit sorts your findings into the six categories an AgentExchange (formerly AppExchange) Security Review reviewer checks, and gives each one, and the package, a verdict: READY or GAPS.

vulkro-sf appexchange-report ./my-package --format table

It is not a second scan. It takes the findings the scan already produced and groups them the way the reviewer thinks, so you see which categories would fail before you pay for a review.

The six categories

The IDs are stable, so a verdict is comparable from run to run.

ID	Category	What it covers
SF-ASRR-001	Authorization (CRUD / FLS / sharing)	Object and field access checks before every query and DML; user-mode SOQL; a sharing mode on every Apex class. The most common cause of a failed first review.
SF-ASRR-002	Input validation and output encoding	No injection into dynamic SOQL or Visualforce; output encoded for its context; no DOM XSS in LWC or Aura.
SF-ASRR-003	Secrets and credentials	No hardcoded keys, passwords or Connected App secrets; credentials in Named Credentials or protected custom settings and metadata.
SF-ASRR-004	External communication	HTTPS callouts with a valid chain; Named Credentials for outbound auth; Connected App scopes narrower than Full.
SF-ASRR-005	Cryptography	No MD5, SHA-1, DES, RC4, ECB mode or predictable randomness for tokens.
SF-ASRR-006	Logging, errors and data exposure	No PII or secrets in debug logs or errors; no stack traces to users; no over-exposed sensitive fields.

Reading the verdict

• READY on a category: no finding gates it, as far as the local scan can see.
• GAPS on a category: at least one gating finding sits in it. Each is listed with its ID and fix.
• Overall: READY only when every category is READY.

READY is a strong signal, not a guarantee. A human reviewer also judges documentation, data handling and design, which no static scan can check. Work each GAPS category down to READY, re-run, then submit.

Where it fits

1. Run the platform code analyzer the review requires and fix what it reports.
2. Run vulkro-sf scan and the readiness audit until the verdict is READY.
3. Prepare the submission documentation.

See also: AgentExchange readiness report, The review process