We plan to submit our managed package for security review. We do not have a usecase document for the app. Do we need to provide it for the security review? If yes, do we need to document the basic usecases or a thorough list of all usecases for the app?
At least the last time I was part of an ISV, yes, this document is required and you cannot proceed without it. Each element in your package simply needs a brief description of what it does. For example, Visualforce Page ABC might be a screen to capture credit card details, and Apex Class ABCController would be the controller for that page. You don't need to be super-descriptive, just enough to give an idea of what each element does (in our docs, each component was described by a simple one sentence description). This is probably the minimum amount of documentation you should have for your app anyways.