FAQ-000793 - External Content and Iframe Security / Iframe Permissions and Managed Package Policies

Yes, iframes loading external content are permitted in managed packages and Visualforce pages for AppExchange applications. However, the external application or content loaded within the iframe will be included in the scope of the AppExchange security review and must comply with Salesforce's security requirements.

The existing answer is accurate and well-structured. No security rules from the available list directly apply to iframe permissions in managed packages - the available rules focus on specific code vulnerabilities (like XSS, CSRF, hardcoded credentials) rather than iframe policy questions. The FAQ correctly states that iframes are permitted but subject to security review scope, which aligns with AppExchange security practices. The answer maintains appropriate brevity while covering the key points developers need to know. No changes are needed as the content is current, clear, and addresses the question completely.