9

I have created a managed package which i have submitted for code review after it passed the review through checkmarx code reviewer with no vulnerabilities. I have been using Tooling API in my managed package to do operations like update class/triggers . Everything happens within salesforce. No external web applications used or webservices are being used.

But the Tooling API required the endpoint in remote site setting. Obviously that is salesforce endpoint.

I get response mail from Salesforce review asking me for BURP scan result and credentials for composite piece of my application.

Since I am just using Tooling API and salesforce endpoint why is BURP scan needed. Also Its 100% native app with no external web application interface.

Please suggest on how to proceed.

Improve this question

1 Answer 1

Reset to default
1

I'd go back to the security review people with the clarification that you are only using native Salesforce resources.

Somewhere Salesforce states that they don't want you pointing the automated security scanning tools at their services.

Improve this answer
2
  • I've never seen that! Does this perhaps mean that their services won't pass the scans? Would be amusing.
    – LucidLunatic
    Jul 3, 2016 at 1:46
  • I suspect it is more that they don't want the load of the scanning tools as they try all the various permutations.
    – Daniel Ballinger
    Jul 3, 2016 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .