We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. https://qa.mywebapp.com.
After security review we will need to integrate it with our PROD site. e.g. https://prod.mywebapp.com.
For this we will change the call back url in our connected app.
When we submitted our package for review, salesforce asked us to submit burp scan report for https://qa.mywebapp.com.