I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a webservice) with a third party application that is not related to Salesforce in any way.
To pass the security review I am asked to run a security scanner on the third party application and to upload the results, which should contain no security issues on the system. However, the application we are integrating with does have some security issues, so we cannot enter the security review. We have asked the third party to fix the issues multiple times, but they seem unwilling and have not made an effort so far. I don't expect them to fix the issues in the near future.
What can I do to still be able to enter the security review? We have thought of removing the integration and offering that in a separate managed package (which will not be publicly listed), but building an extension package poses a lot of technical difficulties.