I am planning to publish an app on AppEXchange but we have used API(Google Contact Api - Rest API). Should we have to go through web app scanner results.
Salesforce no longer provides licenses to BURP. Instead ZAP is the preferred tool. It should be used for testing and the results submitted. More information is hwere - http://security.force.com/security/tools/webapp/zapbrowsersetup