A security scan report for a non-Salesforce domain might be rejected for these common reasons:
1. **Incomplete Endpoint Coverage**: The report does not include all external endpoints running independently of the Salesforce platform.
2. **Unsupported Scanner**: The scan was not performed using a recommended Dynamic Application Security Test (DAST) scanner, such as ZAP, Burp Suite, HCL AppScan, or WebInspect.
3. **Lack of Documentation**: The report lacks documentation of false-positive findings or does not address flagged issues according to Salesforce security guidelines.
4. **Missing Permissions**: Necessary permissions or authorization for testing external endpoints owned by third parties are not included.
5. **Data Security Issues**: The report fails to demonstrate secure handling of sensitive data, such as authentication credentials or payment information, in compliance with standards like PCI compliance.
6. **Insufficient Scope Details**: The report does not provide enough details about the testing scope, including endpoints involved in data transfer or user authentication.
If external URLs aren't properly included in scan reports, here's how to handle the situation:
1. **Provide a ZAP Scan Report**: Use a ZAP scan report as an alternative, especially if other scanners are not functioning or are taking too long.
2. **Include Remote Site Settings**: For URLs that are part of remote site settings, ensure a ZAP scan report is submitted.
3. **Provide Credentials**: If the URLs are publicly accessible, include credentials for the application with all roles to facilitate proper scanning.
4. **Avoid Sensitive Data Exposure**: Ensure that sensitive data in URLs, such as session IDs or usernames/passwords, is not exposed, as this would be flagged as a high-severity issue.
To avoid rejection, ensure your report is complete, uses approved tools, and adheres to Salesforce's security review requirements.