We are building a managed package and we have an understanding gap on the usage of
Global Interface in the code. Couple of months back our package was rejected in the security review citing usage of Global classes (we didn't use Interfaces back then). We are now going towards the approach of using interfaces, so that the customer installing our product has the flexibility to add enhancements.
E.g., We have a code which saves the account records. Now, we want to give the user the ability to make some modification to the account record before saving, so we will allow them to do this by using a global interface which they can implements. If that class is defined in the configuration, we will process the accounts using the customer's class rather than our own.
This sort-of logic (global interfaces), will be provided at multiple places in the project. So we just wanted to understand if there is any limitations from a security review perspective on the usage of Global Interfaces?
Update There is no limitation in global classes. The security review failed our package stating 'Global classes should not be part of managed package.'. We are partly at fault as most of our classes are Global.
But my question is mainly around the usage of global interfaces and if there are any limitation around it from a security review perspective.