We have developed an AppExchange product and sent it for security review. However, in the feedback it is written to provide Source Code Scanner (Checkmarx) results and web app scan results for non-Salesforce domains. How to do meet these requirements?

Hi @Mohit Edupuganti

Here is the article on

https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_code_analyzer_scan.htm

Hope it helps, 

Thanks