Submit Your Solution for a Follow-Up Review

Our goal is to find as many different types of vulnerabilities as possible, but keep in mind that the security review is a black-box, time-limited process. We can’t always list every instance of a security vulnerability, and we might not initially detect all issue types. Interpret the security review findings as representative examples of the types of issues you must fix. Unless otherwise noted in the report, you’re required to fix all classes of issues across the entire solution.

We’re available to help you analyze the findings and troubleshoot security vulnerabilities. Schedule a technical office hours appointment on the Partner Security Portal.

As you revise your solution, fix only the security issues discovered in the review and the code in the existing package. If you make other revisions, such as functionality changes, we require that the revised solution go through an initial security review. That’s also the case if you spin up a new package for the revised code.

After you fix the solution, collect the materials necessary for us to complete a follow-up review. Rerun the required scanner tools on your revised solution and generate updated scan reports. If you fixed issues in your managed package, provide updated Source Scanner results. If you fixed issues detected on an external endpoint, provide updated ZAP or Chimera scan reports. If applicable, document your responses to false positives.

For more details about what to submit, see Required Materials for Security Review Submission.

The process to request a follow-up review depends on the scope of changes.

• New Package Version—You fixed code that runs on the Salesforce platform. Create and upload a new version of your managed package to your AppExchange listing. Then start a review for the new version. If you also made changes external to the package, include details with your submission.
• External Code or API-Only Solution—You changed only the code that runs externally to Salesforce. Edit your existing security review submission. Provide details about the changes. To alert Product Security that you’re resubmitting your solution, log a support case in the Salesforce Partner Community. For product, specify Partner Community & AppExchange. For topic, specify Security Review. Include your package name, ID, and version in the comments.