I am doing apex rest callout to third party web service but when I ran zap scanner using SOAP UI, it gave me results which are specific to client side but not on server end like xframe options etc. Should I have to fix all of them or should I skip them.

2 Answers 2


I was told that everything marked as Medium or Low needs to be either a) fixed b) explained

So if you think they are false positive, you can upload your ZAP report, and then upload a word doc with an explanation for why they aren't valid errors for this scenario...

EDIT - might be worth taking advantage of Security Review Office Hours to get more info

  • Any valid reason why I should fix them if they are on client side ?
    – Piyush
    May 20, 2015 at 18:45
  • In theiory no, but we are still in the review stage, so I don't know what the final response from SFDC will be yet. That's really a question for your Tech Evangelist to answer, or there are Security Review Office hours where you can ask those questions...see link above May 20, 2015 at 21:10

The current documentation states the following:

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .