Salesforce Security Review for composite app

Question

I have developed a managed package which is using public API's for providing functionality. I have gone through CheckMarx source code scanner and got report as "you do not have any security issues". I searched on google but not able to find any other security source code scanner..here are my questions related to scenario discussed

1. Do i need to use 'BURP' scanner for 'PUBLIC API'? info. about my public API:- They are totally transparent i.e they does not store the
   information..this endpoint directly hits the server and give response..this response is appended in related objects.
2. can you suggest me other tool to scan my apex code?
3. After adding my endpoints to managed package are they visible to user in their Remote Site Settings after installing my app?
4. I am adding custom onclick java buttons to list view of Leads,Accounts and Contacts. So user installing app need to add these buttons from respective search Layouts or can i assign a default layout to user which seems not possible as per my knowledge..i will be happy for improving my knowledge.

Thanks for giving your time and sharing knowledge in advance

Answer 1

You do have to run the BURP scanner on 3rd party APIs and provide a report. It is not just limited to code written by you. There's more about how to use BURP in the documentation, including this how-to video.

There is an exception. If the 3rd party is something that SFDC has scanned prior, they may not need you to provide a BURP report, so you can check with them first.

There are two parts to BURP testing, running the BURP tool and generating the requests.

Running the BURP tool

For that, you can actually request a free Professional BURP license from Salesforce if you meet the criteria listed on the sign up form here (copied below for convenience):

You must meet the following criteria* to qualify for this benefit:

• Be enrolled in the AppExchange or OEM program, and have a Partner Portal login
• Be current with your AppExchange Listing Fees
• Application contains integrations with web-services not residing on the Force.com Platform. If your application completely resides on Force.com, please use the Force.com Security Source Scanner instead.

Generating the requests

You can use cURL or another tool like SOAP UI to generate the requests. For example, with cURL:

curl --proxy 127.0.0.1:8080 -k -X POST -d @myRequestBodyFile.txt https://the.endpoint.url.com