My app has gone through security review for the first time and they failed it stating that the messaging channel component has isExposed to true and that it should be set to false.

Now when I try to change it, it says that message channel of managed package cannot be changed back to isExposed false.

This is a deadlock situation.

Is there any work around? or is this app doomed?

  • what was your solution for this question? Thanks
    – rstrader
    Apr 19, 2023 at 11:50
  • It'd be worth contacting support in this case - they can roll back packages under certain circumstances or potentially make the change for you.
    – Matt Lacey
    Apr 19, 2023 at 13:14
  • @rstrader the app is in prod now. It was such a mess, whole app deployment was stalled for weeks because of this issue. I ended up removing the whole component and not use the messagechannel at all. This messagechannel is half baked component I would stay away from. It is mentioned in the documentation that it has to be true if it is hosted in VisualForce page(which I found out later and they pointed out that is correct way to do it) but then that fails security review.
    – Birey
    Apr 20, 2023 at 12:53

1 Answer 1


Assumming you are building 2GMP solution which has versions released to customers, you can't ask Salesforce to revert them.

I think the following solution can be used.

  1. Deprecate the existing message channels.
  2. Create new (duplicate) message channels having isExposed = false or consider using other options (simple Lightning Custom Events) if possible.
  3. Refactor business functionality to use new approach: hidden message channels or other means like Lightning Custom Events.
  4. If you subscribe to Pilot for components deletion, you may even delete offending message channels in a subsequent release.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .