Our app did not pass Security Review because "The logout function doesn't perform correctly the removal of session data server-side." Our application uses the popular Devise gem (Ruby on Rails) to handle authentication, and I verified that the logout action destroys the session cookie by following the steps under Testing for server-side session termination here: https://www.owasp.org/index.php/Testing_for_logout_functionality_(OTG-SESS-006)#How_to_Test.
There are no screenshots or examples provided in the security review report, so I can't really make sense of the specific issue that's being flagged.
One thing that might be relevant is that we are using the (encrypted) cookie as our session store, so the session cookie isn't invalidated after logout, it is only destroyed. And the logout button is visible on all pages as per the guidelines in the OWASP guide above. I didn't see any requirement in the Secure Coding guidelines that we needed to use a specific type of session store (e.g, database or cache server), only that we needed to handle authentication properly.
Can somebody from the Salesforce Security team help shed some light on the expectations here? Thanks very much!