Security Review: Cloud Service uses and stores OAuth tokens

Question

My customer runs a Cloud Service for many years, that connects with Salesforce orgs via OAuth flow and stores org tokens in its database.

As this service wasn't on the AppExchange my customer did not have to Security Review check any of this infrastructure.

Now this customer became an ISV and we are building and submitting their Managed Package for Security Review.

We wonder if and how we need to document, scan and tests this external site? We feel it is security relevant because it stored credentials AND at least via OAuth Endpoints interacts with Salesforce.

1. So how do we handle this?
2. Document it? How?
3. Chimera or ZAP scan it?
4. Also scan the External Website with an Authenticated Service user?
5. How detailed do we need to document the inner workings of this Service?

Note: the customer might not be able or willing to change any of their existing systems. Especially as they are GA since years and interacting with Salesforce for years.

Answer 1

If part of App Exchange offering is an external app, it will be checked by Security Team the same way the Salesforce App is checked so:

• you need to perform a security scan (Chimera or Zap), fix issues and prepare False Positive Document
• you need to prepare a short description of what the app is doing and what is the architecture (frameworks you used). You will enter it into appropriate form fields during Security Review submission.
• you need to provide a test environment of the external app for Salesforce to perform their own tests. You enter those information together with access to Salesforce test environments.

You can expect that Salesforce Security team will perform a detailed testing, checking things like OWASP Top Ten, scanning open ports, investigating how your credentials are stored and others.

You may fail Security Review if there are some security vulnerabilities in the External App. If your customer is not willing to fix those, you won't be able to publish successfully on App Exchange.

This answer is based on:

• submitting one app with Salesforce frontend and external service
• feedback from a customer who failed a security review with iframed external service
• Salesforce documentation around Security Review submission (https://trailhead.salesforce.com/en/content/learn/modules/isv_security_review/isv_security_review_prepare)