How the AppExchange Security Review Submission Loop Works

The AppExchange security review is a loop, not a gate. You self-assess, submit, get a findings report back, remediate, and resubmit until Salesforce signs off. Knowing what each lap costs, and which findings force one, is what turns a multi-cycle slog into a single pass.

Tekunda takes managed packages through AppExchange security review as a Salesforce PDO. What follows is the loop as we run it.

What happens after you hit submit?

Your submission joins a queue, then three lenses run against it: static code analysis with the Salesforce Code Analyzer, dynamic testing against a running org, and a manual review by Salesforce's product security team. What comes back is a findings report, not a verdict, and every line on it either gets fixed or gets a written explanation. Salesforce states that a solution typically takes 4 to 5 weeks to get through the review, and that for every paid solution sold on the marketplace there is a $999 fee for the initial submission and for any subsequent attempts. That is what makes an extra lap expensive: another invoice, and another trip through the same queue.

What do you fix before the first lap?

Everything a scanner can find without help. Access control enforced in user mode, sharing declared on every Apex class, bind variables instead of concatenated SOQL, escaped output, and secrets in Named Credentials or protected custom metadata rather than in code. The full list, in the order that costs least to work, is in Salesforce Security Review Checklist: What to Fix, In Order. A finding you could have caught yourself is the most expensive kind, because it buys a whole extra lap.

How do you run the loop, step by step?

1. Self-assess. Run the Code Analyzer and your own dynamic scan, triage every finding, and fix the real ones. Salesforce retired the hosted Chimera scanner on 2025-06-16, so the dynamic scan is yours to run now. See Running Your Own Dynamic Scans After Chimera for the accepted tools and the report to attach.
2. Document what is left. Every finding you are not fixing needs its own written justification: scanner and rule, file and line, the data path, and the control that protects it. How to Document False Positives for the Salesforce Security Review covers the format reviewers accept.
3. Assemble the submission. Work the Security Review Requirements Checklist in the Partner Community: scan reports, the false positive document, usage and data flow documentation, credentials for every external system, and a Developer Edition org with seeded data a reviewer can actually drive.
4. Submit, then leave the version alone. The queue is not a place to keep iterating. Freeze the package version you submitted and keep developing on a branch, so the reviewer and your team are never reading different code.
5. Remediate against the report. Treat it as a punch list, and fix each item at its root rather than at the symptom the scanner reported, because the next scan runs against the whole package again.
6. Resubmit with evidence. Answer every finding explicitly, including the ones you disagreed with, and say where the fix lives. Unanswered items are what turn a second lap into a third.

What sends a package around the loop a second time?

The same short list every time: missing CRUD/FLS checks, dynamic SOQL built from input, unescaped output, cross-site request forgery, insecure direct object references, and Apex classes that never declared sharing. Almost all of them are catchable in self-assessment. The other repeat offender is procedural rather than technical, a stale or unexplained scan report or a test org the reviewer cannot log into, which stalls the lap before the code is even read.

Where Tekunda fits

Listed packages are re-reviewed periodically, so the loop never fully closes. Keeping a living remediation log, and rerunning the scans on every release instead of every submission, is what makes the next lap a formality. If you would rather the review was handled by people who have cleared it before, Tekunda builds and packages AppExchange products as a Salesforce PDO.

FAQ

How long does the AppExchange security review take?

Salesforce states that a solution typically takes 4 to 5 weeks to get through the review. A resubmission re-enters the same queue, so plan a second lap into the release schedule rather than assuming a fast track.

How much does the security review cost?

Salesforce documents a $999 fee for every paid solution sold on the marketplace, charged for the initial submission and for any subsequent attempts. A clean first pass is the only way to pay it once.

Is the Salesforce Code Analyzer scan mandatory?

Yes, for managed packages listing on AppExchange. Upload the Code Analyzer results with your submission, alongside a dynamic scan report for every external endpoint your package calls.

What replaced Chimera for dynamic scanning?

Nothing hosted. Since Chimera was retired on 2025-06-16, partners run their own dynamic application security testing with tools such as OWASP ZAP, Burp Suite or Qualys and submit the report.

Do I have to repeat the review?

Yes. Listed packages are subject to periodic re-review, so build remediation and documentation into your release process rather than treating security as a one-time event.