Submit Your Solution for a Follow-Up AppExchange Security Review

The security review report lists the types of security vulnerabilities that Product Security found. For each vulnerability type, the report includes:

• A specific example from your solution
• Steps to reproduce the issue
• Links to documentation or comments about how to fix the issue

Our goal is to find as many different types of vulnerabilities as possible, but keep in mind that the security review is a black-box, time-limited process. We can’t always list every instance of a security vulnerability, and it’s possible that we don’t initially detect all issue types. Interpret the security review findings as representative examples of the types of issues you must fix. Unless otherwise noted in the report, you’re required to fix all classes of issues across the entire solution.

We’re available to help you analyze the findings and troubleshoot security vulnerabilities. Schedule a technical office hours appointment on the Partner Security Portal.

As you revise your solution, fix only the security issues discovered in the review and the code in the existing package. If you make other revisions, such as functionality changes, we require that the revised solution goes through an initial security review. That’s also the case if you spin up a new package for the revised code.

After you fix the solution, collect the materials necessary for us to complete a follow-up review. Rerun the required scanner tools on your revised solution and generate updated scan reports. If you fixed issues in your managed package, provide updated Source Scanner results. If you fixed issues detected on an external endpoint, provide updated Dynamic Application Security Test (DAST) scan reports. If applicable, document your responses to false positives.

For more details about what to submit, see Required Materials for Security Review Submission.