1

We have created managed package and submitted it for security review. We are using connected app to push data into SFDC from our web application. Right now its integrated with our QA site. e.g. https://qa.mywebapp.com.

After security review we will need to integrate it with our PROD site. e.g. https://prod.mywebapp.com.

For this we will change the call back url in our connected app.

When we submitted our package for review, salesforce asked us to submit burp scan report for https://qa.mywebapp.com.

My question is when we will change our integration with https://prod.mywebapp.com then do we need to submit burp scan for https://prod.mywebapp.com?

Improve this question

1 Answer 1

Reset to default
3

It's fine to submit a burp scan for a staging environment, as long as it is functionally equivalent to the production version. For the manual testing, you can also provide test credentials for a staging version of the site.

Improve this answer
2
  • Thank you for your answer Robert. Both QA & prod are functionally same. So, does this means that i can safely change my callback url in connected app to point it to production and it will not force me to go into security review again.
    – AtulRajguru9
    Oct 10, 2014 at 5:12
  • 1
    In the package that you upload to publisher portal the callback should be the production callback. The package that you install in a DE org for testing should have the staging version callback. When, in the Security Review wizard, it asks for credentials, provide credentials for the staging version package. Make a note as to why the production package is different from the one installed in a DE org. This shouldn't cause any problems and has been done before in the Security Review.
    – Robert Sussland
    Oct 10, 2014 at 5:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .