If requested, can you make the most recent Application Code Review or Penetration Testing Reports (carried out by independent third party) available?

Yes.

We have had Salesforce perform an independent penetration test, as part of their "Security Review" (for us in order to be able to be listed on their Salesforce AppExchange). However, they do no provide reports for this.

Note that Salesforce also performs ad-hoc checks going forward. Other than that, we have not yet have an independent third party perform an Application Code Review or Penetration Test, though we intend to also have this done in 2021 and can share the results with you.