When is the External Service Scan required in Salesforce Security Review?

Question

I am currently working with a Salesforce integration in which a third-party system creates/updates records in the Salesforce org using the native REST API of Salesforce. It is a unidirectional integration, External System -> Salesforce. This Salesforce application packages the following metadata:

1. A Connected App for the external system to auth & perform REST callouts to the Org
2. Some custom apex triggers logic (note that it does not perform any callout to the external system)

At this point, I wonder if providing a scan report of the external system (using Chimera or OWASP ZAP) is required in order to pass the security review of the Salesforce Package.

According to the Salesforce documentation, we need to use a data/user-driven approach to know what to test before the security review. In this case, Salesforce data is never going out of the org and no user is asked to login to the external service from Salesforce, therefore I think the external service scan is not required, but packaging of a Connected App in with the Salesforce package makes me hesitate about this.

Anyone around went through a similar scenario?

Answer 1

As per my understanding, even though you have unidirectional integration , it would require scan report of the external system.

For reference , the below link shows the required documents for submission based on solution type. Whether the integration is unidirectional or bidirectional , it requires scan report for external system :

https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_required_materials.htm

Refer the Solution with External Web App or Service column in the table.