I have created a managed package which i have submitted for code review after it passed the review through checkmarx code reviewer with no vulnerabilities. I have been using Tooling API in my managed package to do operations like update class/triggers . Everything happens within salesforce. No external web applications used or webservices are being used.
But the Tooling API required the endpoint in remote site setting. Obviously that is salesforce endpoint.
I get response mail from Salesforce review asking me for BURP scan result and credentials for composite piece of my application.
Since I am just using Tooling API and salesforce endpoint why is BURP scan needed. Also Its 100% native app with no external web application interface.
Please suggest on how to proceed.