The security requirements for external websites or services that your managed package connects to include:
1. **Access to External Components**: Provide access to all external web applications or services used by your solution for security testing.
2. **Authentication Details**: Include URLs and login credentials for external components requiring authentication in your security review submission.
3. **Security Scans**: Conduct security scans (e.g., DAST reports) on external endpoints and include these reports in your submission.
4. **Document False Positives**: Identify and explain any false positives found during security scans.
5. **Secure Coding Practices**: Ensure external endpoints use secure coding practices, such as TLS v1.2 or above, and avoid weak ciphers. Exceptions may be granted for endpoints not under your control, with an action plan.
6. **Control Over External Endpoints**: If the external endpoint is in scope, you must have control over it, including placing a token in the web app root for testing.
7. **CORS and Cross-Domain Policies**: Avoid wildcarded CORS or cross-domain.xml files for non-public endpoints. Use a separate content domain if a general relay is needed.
8. **Secure Session IDs**: Ensure session IDs are marked as SECURE and follow other secure configuration practices.
These measures ensure that all external components connected to your managed package meet enterprise security standards.