I've heard mixed things. If I have an app that primarily uses Salesforce Canvas to operate, is that required to go through the security review? Does it perhaps depend on if it's a managed package vs. non-managed package?

1 Answer 1


There's no technical requirement for Canvas Apps to be approved. In fact, there are very many private canvas apps used by many organizations that are not approved. Many canvas apps are created as a bridge between salesforce.com and some legacy system or other integrated platform. You can choose to have it approved if you want to list your canvas app on the AppExchange publicly.

  • I'm confused a little.Don't we have to do burp scan of external apps integrated with canvas app??
    – Mr.Frodo
    Commented Jul 7, 2016 at 16:57
  • @Mr.Frodo Only if you want to publicly list on the AppExchange.
    – sfdcfox
    Commented Jul 7, 2016 at 17:01
  • @sfdcfox Listing a canvas app on AppExchange would require a managed package right? And that would therefore also require a full security review? Commented Jul 7, 2016 at 17:35
  • @user1813867 Yes, your Canvas App would use a Managed Package that can be approved by a Security Review and attached to your AppExchange Public Listings. If you don't want to be publicly listed, you don't need the managed app or the security review.
    – sfdcfox
    Commented Jul 7, 2016 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .