When dealing with security vulnerabilities and issues in third-party services during the AppExchange Security Review:
**Documentation and Evidence:**
- Document the issues thoroughly and provide evidence that the vulnerability is external to your application
- Provide updated Dynamic Application Security Test (DAST) scan reports
- Include documentation of your responses to any false positives
- Provide detailed solution user documentation and your company's information security policies
- Include any security certifications or reports from the third-party service that demonstrate their compliance with security standards
**Third-Party Communication:**
- Contact the third-party service to report the issue and request a resolution
- If the third party cannot resolve the issue promptly, include their response, certifications, or security reports in your submission
- Provide as many details as possible, such as the target URL, class name, and location when presenting third-party responses
**False Positive Documentation:**
- If the vulnerability does not impact your application's functionality or security, document it as a false positive
- Include this explanation in your submission with supporting evidence
- Document the findings thoroughly and include them in the false positives (FP) documentation
- Submit this documentation as part of your security review submission in the AppExchange Partner Console
**Alternative Documentation for Scanning Restrictions:**
- For integrations with major platforms that do not permit external scanning, provide alternative documentation:
- Submit API documentation, authentication credentials, and available security certifications or compliance reports from the platform
- Ensure sensitive data, such as API keys, is securely stored (e.g., in protected custom settings)
- Follow best practices for data protection
- Document any limitations or constraints regarding external scanning
**Mitigation Strategies:**
- Ensure all external components, such as web applications or services, are securely transferring Salesforce credentials and data
- Avoid reliance on vulnerable components wherever possible
- Ensure your package does not depend on or reference the vulnerable components
- Include a detailed explanation about why the issue is beyond your control and how it does not impact your package's security
This approach demonstrates due diligence and helps mitigate the impact of third-party vulnerabilities on your security review.