Complete the Security Review Cycle

Use the security review wizard in the AppExchange Partner Console to manage your reviews. Submit your solution for an initial review. Resubmit a solution that you revised to correct security issues detected in a previous review. Pay security review fees.

To distribute managed packages, Salesforce Platform API solutions, or Marketing Cloud Engagement API solutions on AppExchange, they must pass our security review.

Note

Watch the video to see how to submit your solution for review in the AppExchange Partner Console.

Required Materials for Security Review Submission
Learn about the materials that you must provide, such as test environments and documentation, when submitting your solution for an AppExchange security review. Mobile apps have platform-specific submission requirements. Extension packages undergo security review and Salesforce requires the same materials for them as for a standalone solution.
Listing Readiness for Managed Packages
Listing readiness indicates whether a managed-released package version is ready to list on AppExchange or if it first must pass security review. Learn the difference between security review status and listing readiness. Discover when and how ‌first- and second-generation package (1GP and 2GP) versions inherit listing readiness from previous versions. Make informed decisions about whether to submit a package version for security review.
Check If Your Package Version Is Ready to List on AppExchange
Listing readiness indicates whether a managed-released package version is approved to list on AppExchange or if it first must pass security review. If the org that contains the package version is connected to the AppExchange Partner Console, go to the Console's Solution tab to quickly see if the version is ready to list.
The AppExchange Security Review Wizard
Submit your solutions for security review using the security review wizard in the AppExchange Partner Console. After you submit, visit the wizard to track the progress of the submission, review feedback from Salesforce, and communicate with us.
Manage Your Security Reviews
Manage your security reviews in the AppExchange Partner Console’s security review wizard. Create and submit your solution for review. Check the detailed status information that’s delivered in the wizard. Communicate directly with the teams working on your reviews. Download your review report. Submit false-positives documentation.
Act on Security Review Results
Approximately 4–6 weeks after you submit a solution for an initial review, your security review is complete. Check the AppExchange Partner Console to see if your solution passed. Learn how to publicly list a solution that passed and how to request a follow-up review for a solution that didn’t.
Periodic Security Re-Reviews on AppExchange
To help safeguard against the latest vulnerabilities, we conduct periodic security re-reviews of AppExchange solutions. These reviews are similar in scope to an initial security review, and they include automated and manual testing. You can voluntarily request a re-review of your solution, or in certain instances we notify you that your solution requires a re-review. In both cases, security review fees apply.

ISVforce Guide

Complete the Security Review Cycle