1

We have integrated our app into salesforce nd it used few of our APIs from saleaforce code.

So in review process, does entire external app needs to be reviewed or only the APIs which were called from salesforce app ?

Improve this question

1 Answer 1

Reset to default
3

"Maybe." The Security Review Team decides on a case-by-case basis on if it's required. Ideally, you should run a vulnerability scan against your APIs anyways, because if they are vulnerable, you are at risk to exposing customer data, which would be a violation of law in most countries. Generally speaking, if your APIs handle customer data, then your application needs to be scanned. If there is a direct path from the Salesforce data to the outside world via a vulnerability, your application may be blocked until it is fixed. There's no such thing as scanning "just the API you call"; if one API call in your application is vulnerable, your entire application is vulnerable.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .