Manage Your Security Reviews | ISVforce Guide

Manage your security reviews in the AppExchange Partner Console’s security review wizard. Create and submit your solution for review. Check the detailed status information that’s delivered in the wizard. Communicate directly with the teams working on your reviews. Download your review report. Submit false-positives documentation.

Start an AppExchange Security Review
To start a security review, launch the security review wizard from the Solutions page in the AppExchange Partner Console. You can enter partial information, then save and finish later.
Edit Your AppExchange Security Review Before You Submit
You started a security review submission for your solution and have more information to provide before you submit. Go back to the security review wizard and continue entering information.
Submit Your Solution for AppExchange Security Review
Submit your solution for security review in the AppExchange Partner Console. Share your solution and all required materials, and pay applicable fees.
Update Your Returned AppExchange Security Review
You submitted your solution for security review. Then the review team returned it to you because something that they need for testing is missing or incorrect. The status of your review is Returned. Go back to the security review wizard, fix the issues, and resubmit.
Check the Status of an AppExchange Security Review
Find the status of your security review in the AppExchange Partner Console. Status updates appear after you submit the solution for review.
Ask Us to Take A Second Look at Our Submission Verification Feedback
When you submit a solution for security review, the submission verification stage of your review begins. During this stage, the review teams assess everything that you included in your submission. If anything is missing or incorrect, they post feedback to the Overview page in the security review wizard and return the submission to you. If you disagree with any of the verification feedback, ask us to take a second look. There’s no charge for us to take another look at our verification feedback.
Download Your AppExchange Security Review Report
When a solution doesn’t pass the AppExchange security review, the vulnerabilities found in your solution are documented in a review report. To download your report, go to the Overview page in the security review wizard.
Resubmit a Returned Security Review Where All Issues Are False Positives
In the submission verification stage, if your scan results indicate security issues that you didn't address with false-positives documentation, the status of your review is set to Returned. Your review is paused until we receive the documentation. Go to the Overview page in the security review wizard, upload a false-positives report, and resubmit your solution. There’s no fee for us to evaluate false-positives documentation.
Resubmit a Failed Security Review Where All Issues Are False Positives
If you receive the results of an AppExchange security review and you determine that all of the issues that we identified are false positives, add a false-positives document to the failed review, and resubmit. There’s no fee for us to evaluate false-positives documentation.
Expired AppExchange Security Review
A security review expires when the reviewed solution no longer meets the criteria for distribution on AppExchange. If the expired review is for a solution that’s linked to a public listing, we remove the listing from AppExchange, but you can relist.
Troubleshoot an Expired Security Review
The most common reasons that an AppExchange security review expires are a missed re-review, overdue review fees, and unpaid revenue sharing. Learn how to troubleshoot the cause of an expired review.