Zap scan commercial APIs used in AppExchange apps?

Question

My Managed package, which will soon be submitted for Security Review to be listed on the AppExchange, uses two commercial REST APIs (one of them is the Open AI API for GPT4).

As someone who submitted countless apps before, I know that external systems must be checked using Chimera, ZAP, or Burp to find, fix, or False Positive document issues.

But that doesn't make a lot of sense for sites where:

• I cannot put Chimera tokens, and where I cannot ask for permission to scan
• It's very likely that the provider has taken care of security issues
• it's unrealistic to have them listen and fix issues reported by me

One could argue not to use such APIs in Salesforce apps, but I doubt that is realistic.

So what do you or what does Salesforce recommend for such situations?

Answer 1

Salesforce maintains a list of public APIs that have already been scanned and "blessed" and therefore don't require Chimera/ZAP scan evidence in your security review submission.

Stripe, for example, is on that list. You can infer some others on the list by looking at other AppExchange products that likely use a given public API.

However, the list is not available publicly. You will need to talk to your PAM or TE to confirm whether an API is on the list -- you can also try opening a Security Review support Case and ask. YMMV on which path will yield an actual response.

Answer 2

From the Security Review Overview:

Q: What if I don’t own the external endpoints or services integrated with my app? Are they still in the scope of my security review?

A: Yes. Our approach is to test all parts of every offering to ensure that our mutual customers and their data are not put at risk. This includes any external web applications or services that are integrated with your solution, even if they are owned by a third party. You will also need to contact the third party for a written consent that permits Salesforce to test their endpoint.

This does feel like a hammer to crack a nut and I would contact Salesforce for an Office Hours call to see if they will out-of-scope the external systems you are using, allowing a simple declaration for each in your submission indicating the agreement to skip such scans.