AgentExchange Security Review now checks UI bundles for client-side security risks, such as cross-site scripting and untrusted scripts. Learn the framework, scan, and coding rules before you submit your package so that it passes review.
Where: This change applies to second-generation managed packages (2GP) that contain UI bundles submitted for AgentExchange Security Review.
How: Before you submit, build with a supported framework version, such as React 18+, and
include a package.json file listing your dependencies. Scan your code using
Salesforce Code Analyzer version 5 or later with the uibundle engine. Then add
the scan report to your submission. If your UI bundle connects to a non-Salesforce service, scan
that service with OWASP ZAP or Burp Suite and include the reports.
After your package is listed, if a critical security issue affects React or a dependency, release a patched package within 7 days. Otherwise, Salesforce can turn off the affected UI bundles in subscriber orgs.
SEE ALSO