We have created one app and planning to list in appexchange as free app. Do we need to pass security review, if yes then is it free or paid?. We have partner developer org to list in Appexchange.
Yes you do have to submit your application for security review; all apps must be vetted to ensure they're not a potential risk to customers' data.
For free apps the review is free, currently it's $2700 for paid applications.