If the security scanner is unable to scan third-party API endpoints your application integrates with, follow these steps:
1. Obtain permission from the third-party owner of the API to conduct security testing, if not already done.
2. Document the issue in detail, including why the scan could not be completed, and provide this documentation during the submission process.
3. Open a support case on the Salesforce support portal, mentioning the issue with the scan progress, and await guidance or approval for a one-time exception.
4. Use alternative tools like ZAP or Burp Suite to attempt scanning the API endpoints, if applicable, and include the results in your submission.
5. Ensure that all other security requirements and documentation, such as authentication credentials and API documentation, are submitted for review.
If you cannot upload verification tokens for third-party API scanning, here are some steps you can take:
1. Provide a detailed document explaining the third-party API, including its security certifications or any available pentest reports, as an alternative to verification tokens.
2. Request consent from the third-party API provider to conduct a security assessment and obtain any relevant security documentation they can provide.
3. If a verification token is required, consider implementing a secure mechanism to temporarily share the token for the review, ensuring it is revoked or updated afterward.
4. Raise a support ticket to discuss the specific constraints and seek guidance from the relevant team on how to proceed.
These approaches can help you meet the scanning requirements while adhering to security protocols and ensure compliance with the security review process.