analyzer · runs in your browser
Apex Security Scanner
Paste an Apex class. It is checked, line by line, against the patterns the AppExchange Security Review rejects most often — the same rules we wire into CI on our own ISV builds. Your code never leaves this page.
Scanned locally · nothing uploaded · 0 lines
what it checks
Real rules, not a vibe check.
Every rule below maps to a concrete, published Security Review failure mode. It is a heuristic source scan — fast and high-signal, but not the full official scan. Here is exactly what it looks for.
Access control
SOQL/SOSL and DML that run in system mode without WITH USER_MODE, WITH SECURITY_ENFORCED, or stripInaccessible.
Sharing
Classes declared "without sharing" — or with no sharing keyword at all — especially behind an @AuraEnabled or REST entry point.
Injection
Dynamic SOQL assembled by string concatenation without bind variables or escapeSingleQuotes.
Secrets & endpoints
Hardcoded passwords, keys, tokens, auth headers, and callout URLs that should live in Named Credentials.
Hardcoded IDs
Literal 15/18-character record IDs that break the moment the package lands in another org.
how it works
About this scanner.
Does my code leave the browser?
No. The entire scan runs client-side in JavaScript on this page. Nothing is uploaded, logged, or sent to a server — you can paste a production class and disconnect your network, and it still works.
Does a clean result mean I will pass the Security Review?
No — and we are deliberate about that. This is a fast first-pass heuristic over the most common, most-rejected patterns. The official review also runs Salesforce Code Analyzer and Checkmarx and a manual architecture review across things a source scanner cannot see (logic, data flow, CSP, stored XSS in LWC). Treat a clean result as "the obvious blockers are gone", not a guarantee.
How is this different from the readiness checklist?
The checklist asks you to rate yourself. This reads your actual Apex and tells you, line by line, where it deviates from the patterns reviewers reject. It is the same logic we wire into CI on our own ISV builds, distilled into the highest-signal rules.
Why did it flag a line that is actually safe?
A source scanner cannot prove intent. If you genuinely need "without sharing", or a query is already gated upstream, treat that finding as a prompt to leave a comment justifying it — which is exactly what a reviewer will ask for. Conversely, it can miss issues that need full data-flow analysis.
Can you take us through the real review?
Yes. We build managed packages to this bar from line one and have taken packages through the AppExchange Security Review. Book a call and we will scan the whole package, not one class.
building on the platform
Shipping a managed package?
We build to the Security Review bar from line one and have taken packages through it. Let us scan the whole package — not one class.