To document your CSRF mitigation for the AppExchange Security Review, follow these steps:
1. **Describe the Mitigation Approach**: Clearly explain the method you used, such as implementing per-request or session-based CSRF tokens. Include details about how the token is generated, its randomness, and how it is validated.
2. **Provide Implementation Details**: Share technical specifics about how the CSRF token is integrated into your solution. For instance, explain how the token is included in requests (e.g., custom headers or hidden form fields) and how the server validates it.
3. **Document Testing and Validation**: Include details about the testing performed to ensure the CSRF mitigation is effective. Mention any tools or methods used to confirm that the token cannot be guessed or reused.
4. **Address False Positives**: If any flagged vulnerabilities are false positives, explain why they are not valid concerns. Provide evidence, such as code snippets or test results, to support your claims.
5. **Attach Supporting Materials**: Include relevant documentation, such as code samples, test results, or reports from security tools, to substantiate your implementation.
Make sure to upload this documentation to the security review wizard in the AppExchange Partner Console as part of your submission.