I am developing an application using a Canvas App. I have an external application that will be displayed in Salesforce using a Canvas Frame. My external application contains links to external websites such as the official app website, etc.

The question: will the security review scan also link to websites? If so, should these websites pass the security scan too?


  • have the same issue here Hugo, my question is it says that I should own the application am testing and should upload prevention token
    – SFDC
    Dec 11, 2017 at 10:13

1 Answer 1


From the Security Review FAQ:

Q: Why does the review team need to test X or Y part of my offering?
A: Our approach is to test all parts of the offering to ensure that our mutual customers and their data are not put at risk. This includes external web applications or services that are required or optional, client/mobile applications that are required or optional and all Apex and Visualforce (packaged or unpackaged) that is included in the offering. If you are not sure if you should include part of your offering include it anyway. The review team will not test parts of the offering that we determine are not in scope, but if it is not included your review will be delayed.

And from the Force.com ISV Security Review - Scope:

The scope of the security review depends on the composition of the offering. Most offerings contain one or more parts that are classified as Native, Composite (Web Applications), or Client/Mobile. Our approach is to test all parts of the offering to ensure that our mutual customers and their data are not put at risk. The table below describes at a high level what testing is performed for each part.

enter image description here

I think it would depend on the nature of the link and if it forms a part of your application.

For instance, if it was just a direct hyperlink to corporate website and the link contains no data related to the Salesforce session then you won't need to scan it as it isn't an active part of the application.

However, if you start including data sourced from the users session or other session details you should consider it part of the application that needs to be tested to protect the users security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.