Security review for paid apps in appexchange

Question

I want send my app to security review of appExchange. Is the Burp Report Compulsory?

Thanks in advance

Answer 1

I don't think it's quoted as mandatory anywhere in the documentation but IMO, it's a like a de-facto standard and it's strongly recommended to do so. It is not explicitly mentioned in the Checklist either.

There's even a free license available for qualifying partners here.

Quoting from the official security documentation page

Accuracy of Results While black-box testing tools can be of great assistance in uncovering major security vulnerabilities, it is important to understand that no tool can identify all vulnerabilities. Additionally, since these tools lack insight into the context of the application, false positives can be produced. The output of this tool should not be considered a comprehensive security assessment of your application; rather it should complement a thorough manual review. The OWASP testing guide can be a valuable asset in determining your application’s security testing plan.

This is a good tutorial (lot of similar helpful resources available) on how to prepare for a security review.

Answer 2

Running the BURP report is mandatory if your application makes callouts to other services. When you submit the security review, you will eventually be asked to submit the BURP report along with it. Otherwise, you can save some time by running the BURP report ahead of time and submitting it with your initial submission. Here's another related SFSE post on using the BURP tool you may find useful: Burp Scanning a Managed Package