2

I have a Salesforce App which passed security review for the first time in the last year. This App also includes integration with external web application, due to this I also submitted a BURP scan report of the external web application. I am not sure about how Salesforce conducts periodic security review and have some queries.

As you may know, Salesforce provides periodic, point-in-time review at an interval determined by salesforce.com (typically anywhere between 6 months to 2 years).

• As per Salesforce documentation for already passed Apps, around the expiry date, Salesforce contacts partners to arrange another review. Can you guide me on how much time Salesforce gives us to prepare for Security Review?

• BURP scan and fixing the issues reported by it can take time. If I could not submit a clean BURP scan report within the time frame provided by Salesforce, Does Salesforce remove package from AppExchange?

• Salesforce charges for Security Review process for paid Apps, as one-time upfront fee, and a small subsequent annual fee. Can you guide me on how much subsequent annual fee Salesforce charges to partners? Salesforce also charges annual listing fee of $150 USD. Is that correct?

Kindly help me with this. Thanks in advance.

Improve this question

1 Answer 1

Reset to default
1

Salesforce will give you ample amount of time to make corrections .I am not sure of exact numbers but depending on issues you have you can have office hours with security review team

Salesforce has every right to remove your package but again most of my experience they will keep send you notifications to correct your issues and only after 3 to 4 warnings and if you are not enough responsive they may remove the package from appexchange listing .

For exact numbers schedule an office hours with them and get clarity.

You can get latest office hours with Sec review team from here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .