I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional integration, External System -> Salesforce. This Salesforce application packages the following metadata:
- A Connected App for the external system to auth & perform REST callouts to the Org
- Some custom apex triggers logic (note that it does not perform any callout to the external system)
At this point, I wonder if providing a scan report of the external system (using Chimera or OWASP ZAP) is required in order to pass the security review of the Salesforce Package.
According to the Salesforce documentation, we need to use a data/user-driven approach to know what to test before the security review. In this case, Salesforce data is never going out of the org and no user is asked to login to the external service from Salesforce, therefore I think the external service scan is not required, but packaging of a Connected App in with the Salesforce package makes me hesitate about this.
Anyone around went through a similar scenario?