Code-level security from the team that wrote the static analyzer.
Most breaches don't start at the firewall. They start in the code, and now in the prompt: Verizon's 2026 DBIR puts vulnerability exploitation at the top of initial access vectors (31%), and prompt injection tops the OWASP Top 10 for LLM applications. We review the application surface line by line, harden the pipeline that ships it, secure AI systems from prompt injection to production monitoring, and turn compliance requirements into engineering controls that run on their own.
Security work that survives code review.
Three things that set our Application Security practice apart.
“Craftsmanship matters more than ever. I ported PMD to Apex in 2014 because other people's code made me unhappy. Now AI writes most of it but the quality did only slightly improve. Deterministic rules are the only honest reviewer left in the room.”
We wrote the static analyzer the rest of Salesforce uses
Robert Sösemann, Salesforce MVP and Aquiva's AI Lead, ported PMD (Program Mess Detector) to Apex. It's the static-analysis core inside Salesforce Code Analyzer today. When your codebase has to pass a security review, AgentExchange or otherwise, the people who shaped the tooling know what it will flag before you run it.
Ten years of AgentExchange security reviews
We shepherd ISVs through the AgentExchange* security review process: pre-review audits, remediation cycles, post-submission hardening, and the operational discipline to keep listings clean across every Salesforce release. See Product Development for the full ISV journey we run around the review.
Engineers, not auditors
The same engineers who build the code review the code. Findings ship as PRs.
*AgentExchange is the new name for AppExchange. See Salesforce’s announcement.
From pre-review audit to post-review hardening.
The AgentExchange security review is where most ISV roadmaps stall. We run the whole arc, from the pre-review audit to the controls that survive every release after.
Pre-review audit
Codebase walkthrough, dependency audit, secret scan, OWASP-pattern review, packaging hygiene check. Build the punch list before submission.
- Line-by-line code walkthrough on the patterns the reviewers flag
- Dependency audit and CVE triage
- Secret-scan across history and CI artifacts
- Packaging, namespace, and metadata hygiene
- Prioritized findings with effort estimates
Remediation
Findings prioritized by risk and submission impact. Same engineers who found them write the fix-forward PRs. Branch hygiene maintained so the listing keeps shipping.
- Risk-and-impact prioritized backlog
- PR-based remediation, not advisory memos
- Regression tests on the flows we touched
- Branch and release hygiene preserved
- Customer-zero install rehearsals
Packaging & submission
Final scratch-org rehearsals, evidence packaging, security review submission materials, and the demo orgs the reviewers need.
- Final scratch-org and sandbox rehearsals
- Evidence package and reviewer-facing notes
- Test orgs provisioned for the review team
- Submission narrative and architecture context
- Rollback path documented and rehearsed
Review response
Direct Q&A with the Salesforce security review team, evidence follow-ups, and fast-cycle remediation when findings come back. We've been through this enough times to know what each reviewer is looking for.
- Direct reviewer Q&A and clarification
- Evidence follow-ups and supplementary materials
- Fast-cycle remediation for returned findings
- Architecture explanations the review team trusts
- Resubmission with the diff highlighted
Post-review hardening
Sustain across releases. Re-review prep on schedule. The controls that ship with the listing stay updated as the platform evolves.
- Release-cycle security regression coverage
- PMD rulesets maintained against new patterns
- Re-review scheduling and prep cycles
- Customer-reported security issue triage
- Controls updated against platform evolution
From line-by-line review to compliance as code.
Five capability areas: code review, pipeline hardening, identity, compliance, and AI security. They cover the surface area where modern applications get breached.
Code-level security review
Line-by-line analysis of your application code for vulnerabilities, misconfigurations, and architectural weaknesses. We don't just scan, we read. Data-layer controls and lineage live on Data & Integrations.
OWASP Top 10, injection patterns, auth flaws, and business logic vulnerabilities.
Third-party library analysis, CVE tracking, license compliance, and supply chain risk.
Hardcoded credentials, exposed API keys, insecure defaults, and environment hygiene.
Prioritized findings, effort estimates, risk scoring, and fix-forward recommendations.
DevSecOps & CI/CD
Security baked into every stage of the development pipeline, from commit to production. Shift left without slowing down.
GitHub Actions, GitLab CI, Jenkins, and Azure DevOps. Build, test, scan, deploy.
Static and dynamic analysis integration, policy gates, and automated triage workflows.
Image scanning, runtime protection, registry policies, and Kubernetes admission control.
Terraform, Pulumi, CloudFormation. Versioned, reviewed, and policy-compliant infrastructure.
Identity & access
Authentication, authorization, and access control across applications and platforms. Credential abuse shows up in the attack chain of more breaches than any other vector: 39%, per Verizon's 2026 DBIR.
OAuth 2, OIDC, SAML, SSO integration, MFA, and passwordless flows.
Role-based and attribute-based access control, fine-grained permissions, and least-privilege enforcement.
Salesforce, Azure AD, Okta, and cross-platform identity bridging with consistent claims and sessions.
Token rotation, refresh strategy, credential vaulting, and exposed-secret remediation.
Compliance engineering
Turning regulatory requirements into automated, auditable engineering controls. The data protection side of compliance lives on Data & Integrations.
Control implementation, evidence collection automation, and continuous compliance monitoring.
Data handling controls, encryption requirements, access logging, and breach notification workflows.
Pre-audit assessments, gap analysis, evidence packaging, and auditor liaison support.
Policy-as-code frameworks, automated enforcement, exception tracking, and attestation workflows.
AI & LLM security
Securing AI-powered applications from prompt to production.
Adversarial prompt testing, jailbreak assessment, input sanitization validation, and injection defense patterns.
Retrieval pipeline audit, data poisoning analysis, context window leakage, grounding verification, and source attribution integrity.
Tool-use permission boundaries, action guardrails, escalation path validation, and multi-agent trust models.
Output filtering, toxicity detection, PII leakage prevention, drift monitoring, and cost-anomaly alerting for production AI systems.
Common questions
What application security services does Aquiva offer?
Code-level security review, AgentExchange security review preparation, DevSecOps pipeline hardening, identity and access management, AI and LLM security, and compliance engineering.
Can Aquiva help pass the Salesforce AgentExchange security review?
Yes. Our team ported PMD (Program Mess Detector), the static-analysis engine inside Salesforce Code Analyzer, to Apex. We run pre-submission audits, fix flagged patterns, and guide ISVs through the full review lifecycle.
Does Aquiva provide AI and LLM security services?
Yes. We secure AI systems from prompt injection to production monitoring, covering model input validation, output filtering, data leakage prevention, and responsible AI governance.
Find the risk. Shrink the surface. Pass the review.
Most security teams find problems after they're in production. Ours find them before.