Security requirements for a one-tester external beta

App Marketplace
1

Hi everyone,

I’m preparing a Zoom App beta with one external adult tester, using fictional discussion and voluntary feedback.

I’ve read the independent-developer beta guidance and evidence guidelines. A few details remain unclear:

  • Are developer-run SAST and DAST reports acceptable, and how should coverage limitations for native SDK/provider components be documented?

  • What TLS evidence is expected for a local HTTPS backend exposed through ngrok, connecting to RTMS and OpenAI? Does the scope include a separate informational website or auxiliary DNS/certificate-revocation traffic?

  • Is the Privacy Policy additional to the three security documents, and which documents must be public versus submitted privately?

  • May an informational website remain public while beta app access is restricted to approved testers?

Pointers to guidance or experience with a similar beta would be appreciated. Thank you!

2

Hello,

Thanks for reaching out in relation to Beta Authorization URL testing questions; please reach out to the team that handles these request the Marketplace security team here: marketplace.security@zoom.us and they can answer that question for you.

Regards, Kwaku

3

Hi Kwaku, thanks for confirming the right contact.

We’ve been corresponding with Marketplace Security since September 27. They provided the initial beta requirements, but our follow-up questions about scan scope, TLS evidence and beta distribution remain unanswered.

Could you help route this thread to the appropriate reviewer or suggest an escalation path? We’re preparing the evidence package for a controlled, one-participant beta and want to ensure it addresses the requirements. Thanks!!