we have developed an app that we are planning to list it in AppExchange. For that, we have completed AE meeting, first round of technical review with a Saleforce Technical Evangelist.
Now, we are waiting for the security review. We already used Force.com Security Scanner and scanned our code. There were few issues came out and we fixed that successfully.
In what ways the security review differs from what we did using the Force.com security scanner? Experts please suggest. Someone who have already posted their paid app in AppExchange had better experience and highly appreciable if they shared their thoughts.
Please note, we are in this process for the first time and our app is an Integration solution between Salesforce and SAP. Most of the stuff are callouts to SAP, VF pages and Apex classes. No triggers.