3

I am working for an existing AppExchange ISV Partner that missed the deadlines for Security Review resubmission. When that happens Salesforce is not only taking your Listing down but also deactivating Push Upgrade and Patch Management.

Not being able to provide patches and at the same time having to prepare for Security Review puts ISV partners in some kind of technical Deadlock. Here is why:

  • You need to support your paying subscribers. In case of bugs, contractual SLA require you to fix in the form of Patches. So you need Patches.

  • You can't use the latest version for that because

    • Not all customers are on the last version and also cannot be forced to
    • If you use Main for Fixes then you cannot put your fixes there that you do for Security review. For submitting for Security review you need to provide a Package scan from the Packaging org.
4
  • 1
    Why they can’t just pass Security Review Resubmission and get all lost features back? Jul 6 at 9:23
  • 3
    If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against Security Review, socialized with the ISV's Salesforce account manager, putting forward a case to have the App Exchange listing added again (perhaps as private for now) and with permission to patch. There's no alternative.
    – Phil W
    Jul 6 at 9:42
  • 4
    For the future, the ISV needs to understand that if they keep Salesforce informed about progress, Salesforce are fine to provide (realistic) submission date extensions. We have had to do this in the past and suffered no issues (typically because of the need to have an Office Hours call with the security team, which always adds a 6 week delay). The mistake here, I suspect, was a failure to engage with Salesforce early enough to avoid this issue.
    – Phil W
    Jul 6 at 9:46
  • @PhilW this is a good real answer. Please convert it. Jul 6 at 10:31

1 Answer 1

6

If there are bugs that require urgent fixing against previous versions of the package, before you will get through Security Review, this needs to be resolved by raising a case with Salesforce against Security Review, socialized with the ISV's Salesforce account manager, putting forward a case to have the App Exchange listing added again (perhaps as private for now) and with permission to patch. There's no alternative.

For the future, the ISV needs to understand that if they keep Salesforce informed about progress, Salesforce are fine to provide (realistic) submission date extensions. We have had to do this in the past and suffered no issues (typically because of the need to have an Office Hours call with the security team, which always adds a 6 week delay). The mistake here, I suspect, was a failure to engage with Salesforce early enough to avoid this issue.

3
  • 1
    Can't stress the second paragraph enough. The Salesforce security review team is generally really good and competent. They want us (ISVs) to succeed. When they hit us with multiple resubmissions at once in 2020, we reached out and they were glad to extend the time. I expect in this case that there were multiple warnings that were ignored before they shut off the listing. Part of being an ISV is paying attention to these things.
    – kibitzer
    Jul 6 at 18:14
  • 1
    After escalating our Support cases (ignored for long) to the right people we got a grace period and all features turned back on. Jul 7 at 10:30
  • That's great to hear.
    – Phil W
    Jul 7 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.