Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record?
e.g. user visits https://[instance].lightning.force.com/c/MyApp.app?contactId=abcd & this creates a 'Receipt' record.
I've read about CSRF tokens in VisualForce, but no such thing for lightning applications. Is there maybe built in CSRF protections built into requests to AuraEnabled methods?