My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.

As this service wasn't on the AppExchange my customer did not have to Security Review check any of this infrastructure.

Now this customer became an ISV and we are building and submitting their Managed Package for Security Review.

We wonder if and how we need to document, scan and tests this external site? We feel it is security relevant because it stored credentials AND at least via OAuth Endpoints interacts with Salesforce.

  1. So how do we handle this?
  2. Document it? How?
  3. Chimera or ZAP scan it?
  4. Also scan the External Website with an Authenticated Service user?
  5. How detailed do we need to document the inner workings of this Service?

Note: the customer might not be able or willing to change any of their existing systems. Especially as they are GA since years and interacting with Salesforce for years.

1 Answer 1


If part of App Exchange offering is an external app, it will be checked by Security Team the same way the Salesforce App is checked so:

  • you need to perform a security scan (Chimera or Zap), fix issues and prepare False Positive Document
  • you need to prepare a short description of what the app is doing and what is the architecture (frameworks you used). You will enter it into appropriate form fields during Security Review submission.
  • you need to provide a test environment of the external app for Salesforce to perform their own tests. You enter those information together with access to Salesforce test environments.

You can expect that Salesforce Security team will perform a detailed testing, checking things like OWASP Top Ten, scanning open ports, investigating how your credentials are stored and others.

You may fail Security Review if there are some security vulnerabilities in the External App. If your customer is not willing to fix those, you won't be able to publish successfully on App Exchange.

This answer is based on:

  • - What if I don't control the external app? - What if my app interacts with an external logging system? - Do I just ZAP scan the public part of the external app or also the features behind a login? Commented Jul 26, 2022 at 13:20
  • Yes, this is what Salesforce recommends "ZAP is a free online scanner created by OWASP. Requires installation on a local system. Use if part of your solution is deployed on a domain that you don’t control." - trailhead.salesforce.com/en/content/learn/modules/… Commented Jul 26, 2022 at 13:37
  • 1
    Welcome to the site Anna, solid first answer.
    – Matt Lacey
    Commented Jul 26, 2022 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .