We are planning to release an offering to AppExchange. Our offering includes clients which interacts sfdc endpoints. However, the client does not interact with gzip encoding. Will it be an issue for the security review?
The client will also be tested. In this case, the best thing to do is set everything up on one of your machines and give them RDP (or equivalent) access, with an admin account. This allows them to log in, install the instrumentation code they need, and conduct the review with the least hassle.
The security review team can't install third party code like this on corporate equipment, and installation of client code is often time consuming, which directly adds to your wait time.
The main thing that they will look for is how/where you store credentials (see the secure coding guidelines for more info), but also what is logged and what data is sent out.