Salesforce has several means of access, including guest access through an unauthenticated user account. Here's some documentation on the matter:
- Force.com Sites: Provide potentially unauthenticated access to a select set of web sites through Force.com.
- SOAP API: Request data using a WSDL file, and render your information within the page's HTML.
- REST API: Request data using standard REST interfaces, and render your information within the page's HTML.
- Integration with the Force.com Platform: A comprehensive document on the various ways you can integrate, including custom REST and SOAP services.
Standard web-based issues apply:
- CORS: Ability to restrict or share resources across domains.
- XSS: Vulnerabilities allowing attackers to make your page do things it shouldn't.
- SOQL Injection: A variant on SQL injection that may unintentionally expose data it shouldn't, although Create, Update, and Delete are protected from the usual SQL injection vulnerabilities, since you can't perform DML operations through SOQL.
- Security Implementation Guide: Includes the above topics and many more permission and security considerations (PDF).
The easiest method would simply be to set up a Force.com Site, build a couple of Visualforce pages (or however many you need), and then embed those pages in iframes in your HTML. As discussed above, there's various means of accessing the data, various types of security concerns (as above), and so on. However, there's little in terms of security concerns that is intrinsic to salesforce.com as opposed to any other system, with the main differences being implementation-specific.
