--- title: "QuickBooks App Security Review Check | Free Tool" description: "Free tool to check a QuickBooks Online app before Intuit’s security review: cache headers, cookies, TLS, OAuth callback and token storage." url: "https://www.apideck.com/tools/quickbooks-review" section: "Tools" --- # QuickBooks App Security Review Check | Free Tool Free tool to check a QuickBooks Online app before Intuit’s security review: cache headers, cookies, TLS, OAuth callback and token storage. ![QuickBooks](https://www.apideck.com/_next/image?url=https%3A%2F%2Fres.cloudinary.com%2Fapideck%2Fimage%2Fupload%2Fv1529456366%2Fcatalog%2Fquickbooks%2Ficon128x128.png\&w=3840\&q=75)Free and [open source (MIT)](https://github.com/apideck-libraries/quickbooks-review-check) · for QuickBooks Online apps ## QuickBooks app review checkFind security-review blockers before you submit Check your deployed app and your code against the issues that most often send QuickBooks Online apps back during Intuit's security review. Free, no sign-up, and your code never leaves your browser. [apideck-libraries/quickbooks-review-check](https://github.com/apideck-libraries/quickbooks-review-check)MIT licensed Deployed appSource code Try a sample:Insecure appSecure app[Code on GitHub](https://github.com/apideck-libraries/quickbooks-review-check/tree/main/examples) Example report for our insecure sample app 17 failed7 warnings3 passed #### Server & transport * FailHTTP does not redirect to HTTPS * FailTLS 1.0 accepted * FailSensitive page cacheable: /dashboard * FailTRACE enabled * FailSensitive page cacheable: /oauth/callback * FailOAuth tokens or realmId written to logsHandled by Apideck * WarningTLS 1.1 accepted * WarningServer advertises TRACE * WarningNo Strict-Transport-Security header * WarningServer version disclosed * PassTLS 1.2 + TLS 1.3 supported * PassCertificate trusted * PassTRACK disabled #### Attack vulnerabilities * FailOpen redirect via /?next= * FailOpen redirect via /?returnTo= * FailOpen redirect via /oauth/callback?next= * FailOpen redirect via /oauth/callback?returnTo= * FailOAuth state parameter is a constantHandled by Apideck * WarningMissing browser security headers * WarningSQL built with string interpolation * WarningNo CSRF middleware detected #### Cookies & sessions * FailCookie sid missing secure + httponly #### OAuth token management * FailEncryption key hardcoded in sourceHandled by Apideck * FailOAuth tokens sent to or stored in the browserHandled by Apideck * FailRefresh token stored without encryptionHandled by Apideck * FailrealmId stored without encryptionHandled by Apideck #### Token-endpoint redirect rule * Fail/oauth/callback returns HTML with tokens in the URLHandled by Apideck ## What is the QuickBooks app security review? It is Intuit's check that a QuickBooks Online app handles customer data and OAuth tokens safely before it can connect to production companies or be listed on the QuickBooks App Store. Reviewers look at transport security, cookies and sessions, common web vulnerabilities, how the app stores OAuth tokens, and how it uses QuickBooks data. Apps for Intuit Enterprise Suite go through the same review. * Apps go through a technical review, a security review and a marketing review before they can be listed on the QuickBooks App Store. The security review starts once the technical review passes. * Critical, high and medium issues found in the security review must be fixed before the app can be published. * Private apps that are not listed still have to complete the app assessment questionnaire once they connect to production QuickBooks Online companies. * Listed apps, and any app with more than 500 connections, are reviewed again at least once a year. Issues found in those reviews must be fixed within two weeks. ## How to check your app before you submit 1. 1 ### Scan the deployed app Enter your app URL and OAuth callback path. The check probes HTTPS, TLS, cache headers, cookies, HTTP methods and the callback redirect. 2. 2 ### Scan the source code Choose your repository folder. It is scanned in the browser for token storage, key handling, logging and CSRF issues. 3. 3 ### Fix what fails Open each failed item for the reason and the fix, or read the requirements guide for fixes per stack. 4. 4 ### Sign off the rest Confirm the items no scanner can prove, such as data usage and access control, before you submit to Intuit. ## What the check covers Results are grouped by the areas Intuit's reviewers look at. Some are verified from outside, some from your code, and some only you can confirm. The [requirements guide](https://www.apideck.com/tools/quickbooks-review/checklist) explains each one with fixes. * Server and transportAutomated HTTPS on every page, TLS 1.0 and 1.1 refused, no-store caching on sensitive pages, TRACE disabled, no tokens in logs. * Cookies and sessionsAutomated Secure and HttpOnly on session cookies, read from your live responses and from cookie settings in your code. * OAuth callbackAutomated The redirect URI answers with a 302 instead of an HTML page, so the auth code and realmId cannot leak through the Referer header. * OAuth token managementCode patterns Refresh tokens and realmIds encrypted at rest, keys kept out of source, tokens kept out of the browser. * Attack vulnerabilitiesCode patterns A fixed OAuth state, missing CSRF protection, open redirects, and SQL, XSS and XXE patterns worth a closer look. * QuickBooks data usageSign-off Flags code that handles QuickBooks data and also imports LLM, analytics or error-tracking SDKs. The rest is your sign-off. Need a penetration test too? This check finds configuration and code patterns. Flaws such as broken access control only show up when someone actively attacks the app. Apideck partners with Aikido for this: [Aikido's AI pentesting](https://www.aikido.dev/attack/aipentest) confirms each finding and delivers a report within hours. ## Four mistakes that cost a review cycle Each one is a small fix once you know it matters. ### Copying the sample app’s OAuth state Intuit’s sample code passes a fixed state value. Shipping it turns off CSRF protection on the connect flow. ``` - authorizeUri({ scope, state: 'testState' })+ authorizeUri({ scope, state: req.session.oauthState }) ``` ### Using private as the cache header private still lets the browser store the page. Pages with QuickBooks data or tokens need no-store. ``` - Cache-Control: private, max-age=0+ Cache-Control: no-store, no-cache, must-revalidate ``` ### Rendering a page on the OAuth callback The callback URL carries the auth code and realmId. Any third-party asset on that page can receive them in the Referer header. ``` - res.send('

Connected!

')+ res.redirect(302, '/app/connected') ``` ### Storing the refresh token as plain text Encrypt the refresh token and realmId with AES before writing them, and load the key from configuration. ``` - db.save({ refreshToken: token.refresh_token })+ db.save({ refreshToken: encrypt(token.refresh_token) }) ``` ## Run it on your machine or in CI The CLI and GitHub Action run the same checks, plus signed-in pages with a session cookie that never leaves your infrastructure. Run the action on every deploy and on a schedule, so a changed header shows up in CI before Intuit's next review. ### Command line Node 20 or later. Nothing to install. Terminal npx ``` # Live checks plus a scan of the current foldernpx @apideck/quickbooks-review-check \ --url https://app.example.com \ --callback /oauth/callback \ --path /dashboard \ --header "Cookie: session=…" \ --source . ``` ### GitHub Action Listed on the [GitHub Marketplace](https://github.com/marketplace/actions/apideck-quickbooks-review-check). Store a test-account cookie as the `QBRC_SESSION_COOKIE` secret. .github/workflows/quickbooks-review\.yml v0 ``` name: QuickBooks review checkon: deployment_status: schedule: - cron: '0 6 * * 1' # every Mondayjobs: check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: apideck-libraries/quickbooks-review-check@v0 with: url: https://app.example.com callback: /oauth/callback paths: /dashboard headers: | Cookie: ${{ secrets.QBRC_SESSION_COOKIE }} source: . ``` [All options on GitHub](https://github.com/apideck-libraries/quickbooks-review-check)[Install from GitHub Marketplace](https://github.com/marketplace/actions/apideck-quickbooks-review-check)[Package on npm](https://www.npmjs.com/package/@apideck/quickbooks-review-check) ## The part you sign off yourself Intuit asks about these, and no scanner can prove them. Every downloaded report ends with this list. 0 of 7 confirmed Shorter review, less to defend Let Apideck run the QuickBooks OAuth flow and store the tokens. With Apideck, the redirect URI, token storage and refresh run on Apideck, and the same integration covers Xero, NetSuite and other accounting platforms. Sign-off checklist \[ ]OS, web server, runtime and dependencies are on current patch levels (e.g. npm audit, Dependabot, base image updates).\[ ]Every route that reads or writes QuickBooks data enforces authentication and checks the user owns that realmId (no IDOR).\[ ]A penetration test or DAST scan of signed-in pages (e.g. Aikido AI pentesting or an OWASP ZAP baseline) shows no XSS, CSRF, injection or access-control issues.\[ ]All database and XML access is parameterized; XML parsers have external entities disabled.\[ ]No QuickBooks data is sent to analytics, LLM, logging or other third-party services outside the app's stated function.\[ ]QuickBooks data is retained only as long as needed for the app's function, and deleted on disconnect.\[ ]Disconnect/revoke flow calls Intuit's revoke endpoint and deletes stored tokens. ## How it compares to Preflight Preflight also checks QuickBooks apps against Intuit's review. Its free action covers the runtime checks on personal accounts; the source checks and reports are in its paid Organization plan. Here everything is free and open source, including for companies. Preflight's paid plan adds affidavit preparation, connection monitoring and expert triage, which this tool does not offer. | Feature | Apideck QuickBooks Review Check | Preflight (free) | Preflight Organization | | - | - | - | - | | Price for a company | Free | Personal accounts only | $49 / month | | Open source | MIT, scanner and action | MIT, action | Not listed | | Run in the browser, no install | | Not listed | Not listed | | GitHub Action | | | | | Command line | npx (Node) | Python script | Not listed | | HTTPS, TLS, cache headers, cookie flags, TRACE, 302 callback rule | | | | | HSTS, certificate, open redirects, version banners, security headers | | Not listed | Not listed | | Refresh token and realmId encryption, key storage | | | | | Tokens in logs or the browser, constant OAuth state | | | | | XSS, injection and CSRF | Code patterns; pentest via Aikido | | Scanner-backed, expert-triaged | | Report | PDF and Markdown, free | Pass/fail in CI | Audit-ready report | | Security-affidavit preparation | | | | | 500-connection re-review monitoring | | | | | Insecure and secure sample apps to try | | Not listed | Not listed | Preflight details as published on [preflightci.dev](https://preflightci.dev) and [Preflight on GitHub Marketplace](https://github.com/marketplace/actions/preflight-qbo-review-check) on October 28, 2026. “Not listed” means their pages do not say. Preflight is a trademark of its owner; check their site for current plans. ## Building on QuickBooks * [QuickBooks integration](https://www.apideck.com/integrations/quickbooks) Data models and coverage for QuickBooks Online through Apideck. * [Intuit’s annual QuickBooks security review](https://www.apideck.com/blog/quickbooks-security-review) Who gets reviewed, what Intuit checks and how to prepare before the vendor emails. * [How to integrate with QuickBooks Online](https://www.apideck.com/blog/how-to-integrate-your-app-with-quickbooks-online) A walkthrough of the QuickBooks Online API and OAuth flow. * [QuickBooks API pricing and the Intuit App Partner Program](https://www.apideck.com/blog/quickbooks-api-pricing-and-the-intuit-app-partner-program) What the partner tiers and API call limits mean for your app. * [Connect QuickBooks through Apideck](https://developers.apideck.com/apis/accounting/quickbooks/configuration) Set up your Intuit app with the Apideck redirect URI. * [Accounting API](https://www.apideck.com/accounting-api) One API for QuickBooks, Xero, NetSuite and more. * [Vault](https://www.apideck.com/products/vault) Hosted OAuth, token storage and refresh for every connection. ## Frequently asked questions If every check passes, will Intuit approve my app? No. This is a self-check, not a certification, penetration test or security audit. It catches common, mechanical issues. Intuit decides on approval through its own review, which this tool does not replicate and has no part in. Is the QuickBooks app review check open source? Yes. The scanner is MIT licensed on GitHub at github.com/apideck-libraries/quickbooks-review-check. The code that scans your repository in this page is the same code, so you can read exactly what runs in your browser. Issues and pull requests for new checks are welcome. Does this apply to Intuit Enterprise Suite apps? Yes. Intuit’s Intuit Enterprise Suite developer docs say to follow the QuickBooks Online publishing steps, which are identical, including the same three-part technical, security and marketing review before listing on the QuickBooks App Store. Existing QuickBooks Online integrations keep working when a company moves to Intuit Enterprise Suite, so the same security requirements and this check apply. How is this different from Preflight? Both check QuickBooks Online apps against Intuit’s published security requirements. Preflight’s free GitHub Action runs six runtime checks on personal accounts; its source-level checks, reports and organization use are in a $49 per month plan, which also offers security-affidavit preparation, 500-connection monitoring and expert triage. The Apideck QuickBooks Review Check is free and MIT licensed for everyone, including companies, runs in the browser as well as in CI, and includes the source checks, extra runtime checks and a PDF report. Details as published by Preflight in October 2026. Is this tool affiliated with Intuit? No. It is a free tool from Apideck. Intuit has not endorsed or reviewed it. The requirements it checks are our reading of Intuit’s public documentation, which can change. What happens to my code when I scan it? Nothing leaves your browser. The source scan reads the folder you choose inside this tab and runs the same rules locally. No file is uploaded to Apideck. Does this replace a penetration test? No. This check looks for known configuration and code patterns. Intuit’s review also tests for XSS, CSRF, injection and access-control flaws that only an active test finds. For that, run a penetration test, for example with Aikido’s AI pentesting. Apideck partners with Aikido: their agents confirm each finding before reporting it, and you get a report within hours. What does the live scan send to my app? About 30 ordinary requests: a few GETs, a TRACE, TRACK and OPTIONS request, one call to your OAuth callback with fake parameters, and redirect probes with a harmless test URL, plus four TLS handshakes. Only scan apps you own or are authorized to test. How is the review different when I connect QuickBooks through Apideck? You still register your own Intuit app and complete Intuit’s assessment. With Apideck, the OAuth redirect URI, token exchange, token storage and refresh run on Apideck, so those items are no longer code you write and host. Your app’s own HTTPS, cookies, cache headers, CSRF and XSS protection, and how it uses QuickBooks data, stay with you. Do I need to keep checking after my app is approved? Intuit reviews listed apps, and apps with more than 500 connections, again over time. Re-run the check after changes to your hosting, headers or OAuth code. Last updated October 28, 2026 This tool is provided as is, without warranty of any kind. It is a self-assessment aid and not legal, compliance or security advice. Results do not guarantee that an app meets Intuit's requirements or will be approved. You are responsible for your app's security and for confirming requirements against [Intuit's official documentation](https://developer.intuit.com/app/developer/qbo/docs/go-live/publish-app/security-requirements). Only scan systems you own or are authorized to test. Not affiliated with, endorsed by or sponsored by Intuit Inc. Intuit and QuickBooks are trademarks of Intuit Inc., used here only to describe what the tool checks against.