FAQ-000850 - External Platform Security / External System Responsibility and Control

The difference between package security issues and external site security issues in the Salesforce AppExchange Security Review is: - **Package Security Issues**: These are vulnerabilities within the managed package itself, such as insecure Apex code, Visualforce pages, or Lightning components. They're identified using tools like the Salesforce Code Analyzer and Source Code Scanner, focusing on compliance with Salesforce's security guidelines. - **External Site Security Issues**: These involve vulnerabilities in external components interacting with the Salesforce package, like web applications, APIs, or third-party services. They're assessed to ensure secure data transfer and authentication between Salesforce and external systems, often using Dynamic Application Security Testing (DAST) and reviewing external endpoints for security compliance.

The FAQ content is accurate and well-structured. I made minor improvements to enhance readability and flow: removed the word 'such' in the first bullet point and changed 'They are identified' and 'They are assessed' to 'They're identified' and 'They're assessed' to follow the conversational tone guidelines. These changes make the text more natural and slightly more concise while preserving all the original information and structure. Regarding the selected security rules: These rules directly relate to the package security issues mentioned in the FAQ. ApexBadCrypto, ApexCRUDViolation, ApexCSRF, ApexDangerousMethods, ApexInsecureEndpoint, ApexOpenRedirect, ApexSharingViolations, ApexSOQLInjection, ApexXSSFromEscapeFalse, and ApexXSSFromURLParam all detect vulnerabilities in Apex code as described in the FAQ's definition of package security issues. VfCsrf, VfHtmlStyleTagXss, and VfUnescapeEl identify security issues in Visualforce pages, also mentioned as package security examples. AvoidInsecureHttpRemoteSiteSetting and AvoidDisableProtocolSecurityRemoteSiteSetting relate to external site security issues by ensuring secure connections to external systems, which aligns with the FAQ's description of external site security assessment.