Packaging Apex Applications

Veracode Packaging Requirements

Your Apex applications must meet specific compilation requirements before you can submit them for scanning.

See Supported Languages and Platforms for instructions for other platforms.

Veracode supports analyzing Apex and other application components that extend the Salesforce platform.

Supported Apex Versions

Language Supported Versions
Apex 49.0 and earlier

Supported Apex Libraries and Technologies

Framework/Technology Supported Versions
Visualforce Pages 49.0 and earlier
Lightning Web Components 49.0 and earlier
Aura (Lightning) Components 49.0 and earlier

Required Files

Veracode requires source files for the Apex application.

Packaging Guidance

Upload a ZIP archive containing these files to Veracode:

  • All Apex source code
  • Visualforce pages
  • Lightning component source, including any application pages, component files, HTML templates, and JavaScript code from Lightning web components

Files must be UTF-8 encoded.

Do not include third-party packages. Do not upload individual Apex source files.

Veracode only scans Apex files with these extensions:

  • APP
  • CLS
  • CMP
  • COMPONENT
  • EVT
  • PAGE
  • TGR
  • TRIGGER
  • VFP

Accessing Apex, Visualforce, and Lightning Components

You can access the components of your Salesforce applications to prepare them for analysis in one of these ways:

  • Download source code files individually in the Developer Console
  • Use Salesforce extensions for Visual Studio Code
  • Use the Force.com IDE
  • Use the Salesforce Ant Migration tool

For assistance using any of these tools, see the Salesforce documentation.