---
schema_version: "1"
id: e1dcd960c115404887377e663cefedb799ef4c56b0b4f5ab2a97e44b4a028683
title: Produce Code Analyzer Reports for AppExchange Security Review
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/code-analyzer/salesforce-code-analyzer/guides/appexchange.md
canonical_url: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/appexchange.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 7026e4f4c636310f6653b82c85004c4f626c3fa66a15b52efff2295e942958c7
products:
  - Salesforce Code Analyzer
---
# Produce Code Analyzer Reports for AppExchange Security Review

If you're an AppExchange partner and plan to list a managed package on AppExchange, the package must undergo and pass security review. Part of the security review process is scanning your code with Code Analyzer and uploading the scan reports.

To produce the required scan reports for your AppExchange listing, you must run Code Analyzer using the CLI commands, either using VS Code's integrated terminal or in a standalone terminal or command window. Use `--rule-selector AppExchange --rule-selector Recommended:Security` to select the required rules and `--output-file` to generate HTML output. For example:

```bash
sf code-analyzer run --rule-selector AppExchange --rule-selector Recommended:Security --output-file CodeAnalyzerReport.html
```

Then attach your scan reports to your submission in the AppExchange Security Review Wizard. See [Scan Your Solution with Salesforce Code Analyzer](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm) for details.

**tip:** When you submit your code and scan reports to the AppExchange Security Review, it's not necessary for the scans to be 100% passing. The main requirement is that you run the scans, address all the violations you can fix, re-run the scans, and then submit the reports. Some violations, like false positives, may not be fixable, and the AppExchange Security team understands these situations and adjusts their review accordingly.