We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that custom REST resources. This is part of our app which we are planning to Salesforce Security Review.
My question is, do we need to submit ZAP or Burp report for those custom REST resources? Please suggest.