---
schema_version: "1"
id: 1982edc935c5d1402d83faf9702b9cae7fc0059ce5c00cee400b4f3498fa8819
title: Build Secure UI Bundles That Pass AgentExchange Security Review
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_appexchange_build_secure_ui_bundles.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_appexchange_build_secure_ui_bundles.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2bf3d8f147ffbad98bdf9ba23f779a251a3f86ea50636567dff3eeac143bedbe
description: AgentExchange Security Review now checks UI bundles for client-side security risks, such as cross-site scripting and untrusted scripts. Learn the framework, scan, and coding rules before you submit your package so that it passes review.
products:
  - Cross Cloud
release: "264"
---
# Build Secure UI Bundles That Pass AgentExchange Security Review

AgentExchange Security Review now checks UI bundles for client-side security risks, such as cross-site scripting and untrusted scripts. Learn the framework, scan, and coding rules before you submit your package so that it passes review.

**Where:** This change applies to second-generation managed packages (2GP) that contain UI bundles submitted for AgentExchange Security Review.

**How:** Before you submit, build with a supported framework version, such as React 18+, and include a package.json file listing your dependencies. Scan your code using Salesforce Code Analyzer version 5 or later with the `uibundle` engine. Then add the scan report to your submission. If your UI bundle connects to a non-Salesforce service, scan that service with OWASP ZAP or Burp Suite and include the reports.

After your package is listed, if a critical security issue affects React or a dependency, release a patched package within 7 days. Otherwise, Salesforce can turn off the affected UI bundles in subscriber orgs.

**SEE ALSO**

[_ISVforce Guide:_ Secure UI Bundles for AgentExchange](https://developer.salesforce.com/docs/platform/isvforce/guide/security-review-secure-ui-bundles.html)

#### See Also

- [_ISVforce Guide_: Secure UI Bundles for AgentExchange](https://developer.salesforce.com/docs/platform/isvforce/guide/security-review-secure-ui-bundles.html)