1

We are about to submit our app for the security review process. I have created two REST resources in Salesforce and they are accessed from SAP system. SAP will send JSON i/p to Salesforce using that custom REST resources. This is part of our app which we are planning to Salesforce Security Review.

My question is, do we need to submit ZAP or Burp report for those custom REST resources? Please suggest.

Improve this question

1 Answer 1

Reset to default
1

As mentioned in Force guide, SF accepts only APIs for client apps to communicate and hence as a part of security review API-only app security review. If app has callouts to any other application other than SF, they ask for web application scanner report. They do accept ZAP (Zed Attack proxy) and Burp reports too. Let me know if that was helpful.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .