3

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating Push Upgrade and Patch Management.

Not being able to provide patches and at the same time having to prepare for Security Review puts ISV partners in some kind of technical Deadlock. Here is why:

  • You need to support your paying subscribers. In case of bugs, contractual SLA require you to fix in the form of Patches. So you need Patches.

  • You can't use the latest version for that because

    • Not all customers are on the last version and also cannot be forced to
    • If you use Main for Fixes then you cannot put your fixes there that you do for Security review. For submitting for Security review you need to provide a Package scan from the Packaging org.
Improve this question
4
  • 1
    Why they can’t just pass Security Review Resubmission and get all lost features back?
    – Alex Kalatski
    Commented Jul 6, 2022 at 9:23
  • 3
    If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against Security Review, socialized with the ISV's Salesforce account manager, putting forward a case to have the App Exchange listing added again (perhaps as private for now) and with permission to patch. There's no alternative.
    – Phil W
    Commented Jul 6, 2022 at 9:42
  • 4
    For the future, the ISV needs to understand that if they keep Salesforce informed about progress, Salesforce are fine to provide (realistic) submission date extensions. We have had to do this in the past and suffered no issues (typically because of the need to have an Office Hours call with the security team, which always adds a 6 week delay). The mistake here, I suspect, was a failure to engage with Salesforce early enough to avoid this issue.
    – Phil W
    Commented Jul 6, 2022 at 9:46
  • @PhilW this is a good real answer. Please convert it.
    – Robert Sösemann
    Commented Jul 6, 2022 at 10:31

1 Answer 1

Reset to default
6

If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against Security Review, socialized with the ISV's Salesforce account manager, putting forward a case to have the App Exchange listing added again (perhaps as private for now) and with permission to patch. There's no alternative.

For the future, the ISV needs to understand that if they keep Salesforce informed about progress, Salesforce are fine to provide (realistic) submission date extensions. We have had to do this in the past and suffered no issues (typically because of the need to have an Office Hours call with the security team, which always adds a 6 week delay). The mistake here, I suspect, was a failure to engage with Salesforce early enough to avoid this issue.

Improve this answer
3
  • 1
    Can't stress the second paragraph enough. The Salesforce security review team is generally really good and competent. They want us (ISVs) to succeed. When they hit us with multiple resubmissions at once in 2020, we reached out and they were glad to extend the time. I expect in this case that there were multiple warnings that were ignored before they shut off the listing. Part of being an ISV is paying attention to these things.
    – kibitzer
    Commented Jul 6, 2022 at 18:14
  • 1
    After escalating our Support cases (ignored for long) to the right people we got a grace period and all features turned back on.
    – Robert Sösemann
    Commented Jul 7, 2022 at 10:30
  • That's great to hear.
    – Phil W
    Commented Jul 7, 2022 at 10:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .