I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. non-managed package?


There's no technical requirement for Canvas Apps to be approved. In fact, there are very many private canvas apps used by many organizations that are not approved. Many canvas apps are created as a bridge between salesforce.com and some legacy system or other integrated platform. You can choose to have it approved if you want to list your canvas app on the AppExchange publicly.

| improve this answer | |
  • I'm confused a little.Don't we have to do burp scan of external apps integrated with canvas app?? – Mr.Frodo Jul 7 '16 at 16:57
  • @Mr.Frodo Only if you want to publicly list on the AppExchange. – sfdcfox Jul 7 '16 at 17:01
  • @sfdcfox Listing a canvas app on AppExchange would require a managed package right? And that would therefore also require a full security review? – user1813867 Jul 7 '16 at 17:35
  • @user1813867 Yes, your Canvas App would use a Managed Package that can be approved by a Security Review and attached to your AppExchange Public Listings. If you don't want to be publicly listed, you don't need the managed app or the security review. – sfdcfox Jul 7 '16 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.