Checkmarx Scan (Platform)
FieloPLT v2.209 scanned on 28 September 2026
Fielo conducts an internal security review on every major release using a code scanning tool powered by Checkmarx.
The process goes like this: the scan identifies potential vulnerabilities and for each one, we either address the issue or document it as a false positive.
Results
FieloPLT contains 183 Apex classes that are entry points into the package.
183 entry point Apex classes, broken down by type
All of them were scanned for security. Here is the final report:
| Query | Group | Issues | False Positives | Rectifications |
|---|---|---|---|---|
| Apex VF Dynamic JS Resource | Apex Critical Security Risk | 3 | 3 | – |
| Apex VF Dynamic CSS Resource | Apex Critical Security Risk | 22 | – | 22 |
| Apex SOQL SOSL User Mode Missing | Apex Critical Security Risk | 500 | 500 | – |
| Apex SOQL SOSL Security Enforced Usage | Apex Critical Security Risk | 3 | – | 3 |
| Disallowed Password APIs | Apex Critical Security Risk | 1 | 1 | – |
| SOQL SOSL Injection | Apex Critical Security Risk | 41 | 36 | 5 |
| Stored XSS | Apex Critical Security Risk | 1 | 1 | – |
| Stored XSS in Visualforce Page | Apex Critical Security Risk | 19 | – | 19 |
| Avoid Create Element With Script Link Tag | Apex Critical Security Risk | 1 | 1 | – |
| Lightning API Version | Apex Critical Security Risk | No issues found | – | – |
| Reflected XSS | Apex Critical Security Risk | No issues found | – | – |
| Sharing | Apex Serious Security Risk | 500 | 500 | – |
| Apex CRUD Create Violation | Apex Serious Security Risk | 181 | 181 | – |
| CRUD Update | Apex Serious Security Risk | 99 | 98 | 1 |
| CRUD Delete | Apex Serious Security Risk | 36 | 33 | 3 |
| Apex CRUD ContentDistribution | Apex Serious Security Risk | 1 | 1 | – |
| URL Redirection Attack | Apex Serious Security Risk | No issues found | – | – |
| XSRF | Apex Serious Security Risk | No issues found | – | – |
| Client DOM Stored Code Injection | JavaScript High Risk | No issues found | – | – |
| Client DOM Code Injection | JavaScript High Risk | No issues found | – | – |
| Client DOM Stored XSS | JavaScript High Risk | No issues found | – | – |
| Client DOM XSS | JavaScript High Risk | No issues found | – | – |
| Client Overly Permissive Message Posting | JavaScript Low Visibility | No issues found | – | – |
Updated 16 days ago
Did this page help you?