What are the alternatives for endpoint scanning if the automated scanner cannot access my endpoints and uploading a verification token is not feasible?
Answer
If the automated scanner can't access your endpoints and uploading a verification token isn't feasible, here are some alternatives:
1. Use a staging version of the endpoint that is functionally equivalent to production for testing purposes.
2. Consider exposing a REST API endpoint with restricted access through specific profiles or permission sets to securely manage verification tokens.
Make sure to carefully implement and thoroughly vet these approaches to avoid introducing vulnerabilities. Let me know if you need more details!
What are the alternatives for endpoint scanning if the automated scanner cannot access my endpoints and uploading a verification token is not feasible?
Recommended Answer Update
If the automated scanner can't access your endpoints and uploading a verification token isn't feasible, here are some alternatives:
1. Use a staging version of the endpoint that is functionally equivalent to production for testing purposes.
2. Consider exposing a REST API endpoint with restricted access through specific profiles or permission sets to securely manage verification tokens.
Carefully implement and thoroughly vet these approaches to avoid introducing vulnerabilities. Let me know if you need more details!
Reasoning
The FAQ content is accurate and addresses legitimate workarounds for endpoint scanning challenges during AppExchange security review. I made only minor wording improvements to make the tone more conversational and direct, changing "Make sure to" to "Carefully" for a more natural flow. The two related security rules I selected are directly relevant to the FAQ's technical content: ApexInsecureEndpoint relates to the FAQ's discussion of exposing endpoints for verification token management and ensuring they are properly secured, while ApexSuggestUsingNamedCred is relevant because the FAQ discusses endpoint access and external service connectivity, areas where Named Credentials are recommended for secure authentication. The FAQ's advice about using staging environments and implementing restricted REST API endpoints aligns with security best practices for external service testing.