I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional integration, External System -> Salesforce. This Salesforce application packages the following metadata:

  1. A Connected App for the external system to auth & perform REST callouts to the Org
  2. Some custom apex triggers logic (note that it does not perform any callout to the external system)

At this point, I wonder if providing a scan report of the external system (using Chimera or OWASP ZAP) is required in order to pass the security review of the Salesforce Package.

According to the Salesforce documentation, we need to use a data/user-driven approach to know what to test before the security review. In this case, Salesforce data is never going out of the org and no user is asked to login to the external service from Salesforce, therefore I think the external service scan is not required, but packaging of a Connected App in with the Salesforce package makes me hesitate about this.

Anyone around went through a similar scenario?

1 Answer 1


As per my understanding, even though you have unidirectional integration , it would require scan report of the external system.

For reference , the below link shows the required documents for submission based on solution type. Whether the integration is unidirectional or bidirectional , it requires scan report for external system :


Refer the Solution with External Web App or Service column in the table.

  • Thanks, this document and your point makes sense, but it does not resolve 100% my question, as even that document says "To determine testing scope, we typically use a follow-the-data approach", and the data is not going out of salesforce. Anyhow, you made a good point. I will wait for more answers in this post and mark yours as accepted if I don't get any other clarification. Thank you! Commented Mar 18, 2023 at 17:11
  • 1
    @ManuelMoya: Sure 👍, The doc also states - Either the endpoint uses a connected app that doesn’t require a manual entry or Salesforce data is transferred to or from the endpoint are within the scope of the security review.
    – Rohit
    Commented Mar 18, 2023 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .