Table of Contents [expand]
Last updated January 21, 2026
Add-on partners must follow these requirements before offering their services with Heroku.
Security Guidelines
For guidelines on how to build a secure add-on service, refer to the Salesforce documentation for AppExchange partners. Some of this documentation is specific to AppExchange and not relevant to Heroku, but they are the guidelines for maintaining a Security Policy and how to Prevent Secure Coding Violations are relevant for Heroku add-ons.
Reporting Security Vulnerabilities to Heroku
Add-on providers can report suspected Heroku security vulnerabilities as outlined out in the Heroku Security Policy.
For less urgent matters, reach out to the Heroku team at heroku-ecosystem-partners@salesforce.com for assistance.
Reporting Security Vulnerabilities to Customers
Add-on partners must provide timely, clear, and actionable notifications to affected customers about any identified security vulnerability, including necessary steps for customers to assess and mitigate risks.
Add-on partners must also respond to triaged support requests from customers about potential security vulnerabilities.