Spring '17 (API version 39.0)
Newer Version Available
Yes. Every app and component that is publicly listed on the AppExchange must pass a security review.