FAQ-000941 - External Service Security Testing / Specific Security Testing Requirements

Common security issues found in external web application scans include: Cross-Site Scripting (XSS) – Unsanitized user input that allows script injection. SQL Injection – Vulnerabilities in input fields that allow database manipulation. Cross-Site Request Forgery (CSRF) – Unauthorized actions performed using a logged-in user's session. Insecure Authentication/Session Management – Weak passwords, missing multi-factor authentication, session ID exposure. Open Redirects – URLs that can redirect users to malicious sites. Insecure Transport (HTTP vs HTTPS) – Sensitive data transmitted without encryption. Server Misconfigurations – Default credentials, unnecessary services, or directory listing enabled. Sensitive Data Exposure – Leaking API keys, secrets, or personal data. Security Misconfigurations in Headers – Missing CSP, X-Frame-Options, or HSTS headers. Third-Party Library Vulnerabilities – Outdated JavaScript, CSS, or other dependencies with known security issues.

The content is accurate and comprehensive, covering the major security vulnerabilities found in external web application scans. I made one minor improvement to the last point about third-party library vulnerabilities by adding 'with known security issues' to clarify that it's specifically about libraries with identified vulnerabilities, making it more precise and actionable. Regarding the related security rules: - ApexXSSFromEscapeFalse and ApexXSSFromURLParam relate directly to the XSS vulnerabilities mentioned in the FAQ - ApexSOQLInjection corresponds to the SQL Injection point discussed - ApexCSRF and VfCsrf relate to the Cross-Site Request Forgery vulnerability listed - ApexOpenRedirect matches the Open Redirects security issue mentioned - ApexInsecureEndpoint and AvoidInsecureHttpRemoteSiteSetting relate to the insecure transport (HTTP vs HTTPS) point - ApexBadCrypto relates to authentication/session management security issues - ApexSuggestUsingNamedCred and the hardcoded credentials rules (AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInVarDecls, AvoidHardcodedCredentialsInHttpHeader) relate to sensitive data exposure - VfUnescapeEl relates to XSS vulnerabilities in Visualforce - The LibraryWithKnown*SeverityVulnerability rules directly correspond to the third-party library vulnerabilities point in the FAQ