Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame. My external application contains links to external websites such as the official app website, etc.
The question: will the security review scan also link to websites? If so, should these websites pass the security scan too?
Thanks,
From the Security Review FAQ:
Q: Why does the review team need to test X or Y part of my offering?
A: Our approach is to test all parts of the offering to ensure that our mutual customers and their data are not put at risk. This includes external web applications or services that are required or optional, client/mobile applications that are required or optional and all Apex and Visualforce (packaged or unpackaged) that is included in the offering. If you are not sure if you should include part of your offering include it anyway. The review team will not test parts of the offering that we determine are not in scope, but if it is not included your review will be delayed.
And from the Force.com ISV Security Review - Scope:
The scope of the security review depends on the composition of the offering. Most offerings contain one or more parts that are classified as Native, Composite (Web Applications), or Client/Mobile. Our approach is to test all parts of the offering to ensure that our mutual customers and their data are not put at risk. The table below describes at a high level what testing is performed for each part.
I think it would depend on the nature of the link and if it forms a part of your application.
For instance, if it was just a direct hyperlink to corporate website and the link contains no data related to the Salesforce session then you won't need to scan it as it isn't an active part of the application.
However, if you start including data sourced from the users session or other session details you should consider it part of the application that needs to be tested to protect the users security.
