3rd party integrations
yes, it should match the current scope which you are submitting
like during 1st submission
no, but it sounds Heroku / GCP components you may clarify the expectations
Yes, I did. Last year.
Salami Tactics, Manual Security Review only points to one issue and you need the tooling to detect all of them. Especially important for JS libraries
Checkmarx reports were not ...
I've gone through a resubmission last year. To be fair, the process was fairly straightforward (exactly the same as a normal submission) - but that's because I kept the resubmission in mind after my ...