FAQ-000835 - External Platform Security / External Dependencies and Libraries

To address vulnerabilities like "Insecure Software Version" or "Open Redirect" originating from a required third-party in the AppExchange security review: ### **Insecure Software Version** - Update all third-party dependencies to their latest secure versions. - If the third-party software can't be updated, document the reasons and provide a mitigation plan. - Use secure storage mechanisms, like protected custom metadata, to handle sensitive data. ### **Open Redirect** - Avoid implementing unwanted redirects. If redirection is necessary: - Validate and limit redirects to trusted destinations. - Include a confirmation page or mechanism to inform users before proceeding with the redirect. - If the vulnerability is a false positive, document the use case and provide detailed evidence to support your claim. For both cases, document your responses thoroughly and include them in the security review submission. If you need further assistance, schedule a technical office hours appointment through the Partner Security Portal to discuss specific concerns with the Product Security team.

The FAQ content is accurate and covers the key security concerns well. I made minor language improvements for clarity and consistency: changed 'cannot' to 'can't' for a more conversational tone per the brand guidelines, and streamlined some phrasing while preserving all original points and information. For security rules selection: - **ApexOpenRedirect**: Directly relates to the Open Redirect section of the FAQ which discusses 'Avoid implementing unwanted redirects' and validation of redirects to trusted destinations - **LibraryWithKnownCriticalSeverityVulnerability**: Relates to the Insecure Software Version section which discusses updating third-party dependencies to secure versions - **LibraryWithKnownHighSeverityVulnerability**: Also relates to the third-party dependency security concerns mentioned in the Insecure Software Version section - **LibraryWithKnownMediumSeverityVulnerability**: Connects to the FAQ's guidance on addressing insecure software versions from third parties - **LibraryWithKnownLowSeverityVulnerability**: Relevant to the overall theme of managing third-party library vulnerabilities discussed in the FAQ