My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4).

As someone who submitted countless apps before, I know that external systems must be checked using Chimera, ZAP, or Burp to find, fix, or False Positive document issues.

But that doesn't make a lot of sense for sites where:

  • I cannot put Chimera tokens, and where I cannot ask for permission to scan
  • It's very likely that the provider has taken care of security issues
  • it's unrealistic to have them listen and fix issues reported by me

One could argue not to use such APIs in Salesforce apps, but I doubt that is realistic.

So what do you or what does Salesforce recommend for such situations?

2 Answers 2


Salesforce maintains a list of public APIs that have already been scanned and "blessed" and therefore don't require Chimera/ZAP scan evidence in your security review submission.

Stripe, for example, is on that list. You can infer some others on the list by looking at other AppExchange products that likely use a given public API.

However, the list is not available publicly. You will need to talk to your PAM or TE to confirm whether an API is on the list -- you can also try opening a Security Review support Case and ask. YMMV on which path will yield an actual response.

  • 1
    Good to know. You'd have thought they could make this available to partners at least...
    – Phil W
    Commented Aug 16, 2023 at 14:26
  • That would be great idea if this is available for partner? I am curious if Google APIs / Azure / AWS etc are pre-approved...
    – kurunve
    Commented Aug 16, 2023 at 15:20

From the Security Review Overview:

Q: What if I don’t own the external endpoints or services integrated with my app? Are they still in the scope of my security review?

A: Yes. Our approach is to test all parts of every offering to ensure that our mutual customers and their data are not put at risk. This includes any external web applications or services that are integrated with your solution, even if they are owned by a third party. You will also need to contact the third party for a written consent that permits Salesforce to test their endpoint.

This does feel like a hammer to crack a nut and I would contact Salesforce for an Office Hours call to see if they will out-of-scope the external systems you are using, allowing a simple declaration for each in your submission indicating the agreement to skip such scans.

  • 3
    Ok I will shortly call Sam Altman of OpenAI if I can put a Chimera token in to their site and then ask them to fix the issues Chimera finds :-D Commented Aug 16, 2023 at 13:51
  • 2
    Yup. It's a touch on the silly side. Get an Office Hours with them. Take a fresh haddock with you to slap them round the face... most of all, have fun! :D
    – Phil W
    Commented Aug 16, 2023 at 14:08
  • 1
    🐑 🐠 🐟 🐬 🐳 πŸ‹ πŸ¦ˆβ€Ž
    – identigral
    Commented Aug 18, 2023 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .