Skip to main content

AgentExchange HTML report

vulkro-sf appexchange-report writes one self-contained HTML file that maps every finding to a section of the AgentExchange (formerly AppExchange) Security Review checklist, with a PASS, FAIL or NOT EVALUATED status per section.

vulkro-sf appexchange-report . -o appexchange.html
vulkro-sf appexchange-report . --prepared-for "Example ISV" --prepared-by "Security team" -o appexchange.html

All CSS and scripts are inline: no CDN, fonts or tracking. The file opens the same on an offline laptop and can be archived as is. Use the browser's Save as PDF to attach it to a submission.

Layout​

  1. Cover: project, scan time, the pinned checklist mapping version, a link to the published checklist, optional "Prepared for" and "Prepared by" lines, and one verdict: READY when every covered section passes, GAPS FOUND otherwise.
  2. Coverage note: the report is a readiness indicator, not a guarantee, and lists what static analysis cannot check (penetration testing, live-org configuration, documentation).
  3. Summary: pass, fail and not-evaluated counts, mapped findings, and findings that map to no section, so nothing is dropped.
  4. One row per checklist section: title, description, the rules that cover it, the status, and on FAIL a table of findings (file, line, severity, rule, message).
  5. Submission packet: the review-blocking findings ordered by estimated fix effort, plus any rows imported with --import-code-analyzer and their drafted justifications.

Reading it​

  • PASS: rules cover the section and found nothing.
  • FAIL: a covering rule found something; fix each listed finding.
  • NOT EVALUATED: no rule covers the section. It still needs manual review, and is listed so it cannot pass silently.

Drafted false-positive justifications are never marked accepted: read each one before you upload it.

Typical use​

Run it before every submission, fix FAIL sections until the verdict is READY, and attach the READY report as evidence of a pre-review pass. A consultancy can hand the same file to a customer at the end of an engagement.

See also: AgentExchange readiness report, CLI reference

Last updated on