Complete the Security Review Cycle | ISVforce Guide

Required Materials for Security Review Submission
Learn about the materials that you must provide, such as test environments and documentation, when submitting your solution for an AppExchange security review. Mobile apps have platform-specific submission requirements. Extension packages undergo security review and Salesforce requires the same materials for them as for a standalone solution.

The AppExchange Security Review Wizard
The security review wizard is the tool that you and other ISV partners use to submit your managed packages, Salesforce API solutions, and Marketing Cloud API solutions for security review. After you submit, use the wizard to track the progress of your reviews and to get feedback from and communicate with the teams working on your reviews. The wizard is a feature of the AppExchange Partner Console.

Manage Your Security Reviews
Manage your security reviews in the AppExchange Partner Console’s security review wizard. Create and submit your solution for review. Check the detailed status information that’s delivered in the wizard. Communicate directly with the teams working on your reviews. Download your review report. Submit false-positives documentation.

Act on Security Review Results
Approximately 4–6 weeks after you submit a solution for an initial review, your security review is complete. Check the AppExchange Partner Console to see if your solution passed. Learn how to publicly list a solution that passed and how to request a follow-up review for a solution that didn’t.

Periodic Security Re-Reviews on AppExchange
To help safeguard against the latest vulnerabilities, we conduct periodic security re-reviews of AppExchange solutions. These reviews are similar in scope to an initial security review, and they include automated and manual testing. You can voluntarily request a re-review of your solution, or in certain instances we notify you that your solution requires a re-review. In both cases, security review fees apply.