FAQ-000878 - External Platform Security / Security Scanning and Testing

To properly remove external integrations and avoid web application scan requirements, you should: 1. Eliminate all connections to external endpoints from your application, including code, configurations, or dependencies interacting with third-party services. 2. Document these changes and confirm that no data is being transferred to or from external endpoints. 3. Update your submission package to reflect these changes. 4. Provide a justification for the removal during the security review process. This ensures compliance and avoids unnecessary scan requirements.

The current FAQ content is accurate and well-structured, so no substantial changes are needed. The answer already provides clear, actionable steps that directly address the question about removing external integrations to avoid web application scan requirements. The content is concise, follows the guidelines for being direct and helpful, and maintains appropriate scope without unnecessary elaboration. Regarding the related security rules selected: 1. **ApexInsecureEndpoint**: This rule is directly relevant because the FAQ discusses removing external integrations, which often involve HTTP callouts to external endpoints. When developers are eliminating external connections as described in step 1 of the FAQ, they need to be aware of and remove any insecure endpoint configurations that would trigger this rule during security scanning. 2. **AvoidInsecureHttpRemoteSiteSetting**: This rule relates to the FAQ's guidance about eliminating connections to external endpoints and updating configurations. Remote Site Settings are a key configuration element for external integrations in Salesforce, and removing insecure HTTP remote site settings would be part of the process described in steps 1 and 3 of the FAQ. 3. **AvoidDisableProtocolSecurityRemoteSiteSetting**: This rule is relevant to the FAQ's discussion of removing external integrations and updating configurations to avoid scan requirements. Protocol security settings in Remote Site Settings are another configuration aspect that developers would need to address when following the FAQ's guidance about eliminating external connections and updating their submission package.