Checkmarx Scan

Fielo conducts an internal security review on every major release using a code scanning tool powered by Checkmarx.

The process goes like this: the scan identifies potential vulnerabilities and for each one, we either address the issue or document it as a false positive.

Results

FieloPLT contains 183 Apex classes that are entry points into the package.

183 entry point Apex classes, broken down by type

All of them were scanned for security. Here is the final report:

Query	Group	Issues	False Positives
Stored XSS	Apex Critical Security Risk	1	1
SOQL SOSL Injection	Apex Critical Security Risk	24	24
Sharing	Apex Serious Security Risk	1	1
FLS Update	Apex Serious Security Risk	1	1
FLS Create	Apex Serious Security Risk	6	6
CRUD Delete	Apex Serious Security Risk	15	15
Lightning API Version	Apex Critical Security Risk	No Issues Found	–
Disallowed Password APIs	Apex Critical Security Risk	No Issues Found	–
Reflected XSS	Apex Critical Security Risk	No Issues Found	–
Client DOM Stored XSS	JavaScript High Risk	No Issues Found	–
Client DOM XSS	JavaScript High Risk	No Issues Found	–
Client DOM Code Injection	JavaScript High Risk	No Issues Found	–
Client DOM Stored Code Injection	JavaScript High Risk	No Issues Found	–
XSRF	Apex Serious Security Risk	No Issues Found	–
URL Redirection Attack	Apex Serious Security Risk	No Issues Found	–
Client Overly Permissive Message Posting	JavaScript Low Visibility	No Issues Found	–

Results

What's next