I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application.
According to the instructions in the Security Review wizard:
Offerings that include any non-Salesforce web applications, web services, client/mobile applications (even optionally) must run a Web Application Scanner (Burp) report.
It's possible to grab network traffic from an iOS app via Burp, but the automatic scanning and reporting doesn't really seem possible for a native app like this. What reports will the review team be expecting here?