#Security Review Stage4 utenti parlano di questo argomento

Dear Tableau Support Team, 

We are currently using Tableau Server for our internal business operations. Recently, our internal Security team conducted a security assessment using OWASP ZAP and identified several security vulnerabilities that require further investigation and remediation. 

The scan results identified the following high-risk findings: 

Vulnerability Name Risk Level Number of Instances 

Path Traversal High 1 

SQL Injection – SQLite 2 

Vulnerable JS Library 1 

These findings raise serious security concerns for our organization. In particular, the high-risk vulnerabilities could potentially expose our Tableau Server to security threats and pose significant risks to our business operations and information security compliance. 

Please treat this request as a high priority and provide us with a detailed response and actionable remediation plan at your earliest convenience. 

Hi everyone,

We are preparing an external API / web application integration for our AppExchange Security Review. The review team will need to test our API endpoints from their automated scanning suites and dynamic networks.

Our main operational blocker right now is MFA and Device Activation (OTP). Because our team does not have personnel available on standby 24/7 to instantly provide multi-factor authentication access codes or email OTP tokens to the reviewers, we need an entirely hands-off authentication architecture for our test environment.

Given Salesforce’s strict platform enforcements restricting traditional UI MFA bypass permissions, what is the current accepted practice for API apps?

My Questions:

• If we provision a dedicated Salesforce Integration User license (which uses API-only tokens/OAuth instead of interactive UI login), does the Security Review team's automated testing suite natively support this without triggering an MFA or Device Activation challenge?
• If the review suite requires standard user credentials that trigger an unexpected email OTP, how are partners managing this asynchronously without a 24/7 live operations team to hand over codes?

We want to make sure we architect our authentication flow correctly so that the submission doesn't fail pre-queue validation due to a missed MFA prompt. Any advice from recent submitters would be huge. 

#Appexchage Apps