My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.
As this service wasn't on the AppExchange my customer did not have to Security Review check any of this infrastructure.
Now this customer became an ISV and we are building and submitting their Managed Package for Security Review.
We wonder if and how we need to document, scan and tests this external site? We feel it is security relevant because it stored credentials AND at least via OAuth Endpoints interacts with Salesforce.
- So how do we handle this?
- Document it? How?
- Chimera or ZAP scan it?
- Also scan the External Website with an Authenticated Service user?
- How detailed do we need to document the inner workings of this Service?
Note: the customer might not be able or willing to change any of their existing systems. Especially as they are GA since years and interacting with Salesforce for years.