Our company's internal Information Security folks are used to using Veracode to scan web & app code.
I understand appExchange entries are scanned via SFDC / Checkmarx.
My question is: Is there a way for a customer (us) to view the scan results for available appExchange entries?
Or is the only information available: "pass mean pass"? (And presume if it had failed, it wouldn't be listed)?
If not the results, is the battery of questions or tests performed available? And does pass mean 100% passed?
Is the latest date of scan visible anywhere?