I am aware that Salesforce recently changed some rules for Security Review, which makes the life of ISV and PDO partners harder. Here is another one that I am seeing, and ask for some guidance.

In the good old days:

Security Reviews were - let's say - deterministic. Until you heard back it took a while, but then Salesforce reported many issues. After you fixed them, you mostly always passed. The only reason to fail again was that Salesforce didn't accept your False Positive claims. 


Security Reviews end fast. You fail with one or two issues. You fix them. And then you fail again with something new and unrelated. I know of ISV Partners that failed 6 times until they finally passed.

My Questions:

  1. Can someone confirm that this is indeed a deliberate change?
  2. What's the reasoning behind this?
  3. Is that documented anywhere?
  4. Why is Salesforce not searching all issues? I assume its mostly automated.
  5. How should partners and their customers adjust their expectations? Until now, it was "Prepared professionals always pass immediately."
  6. Is there an updated list of things to check and tools to use? I also see Salesforce use Snyk on many of its fails.

NOTE: It's important to note that in all those cases, those Partners use the tools and checklists that worked for over a decade. So there was always quality in place.

  • 1
    Good call, upvoting this
    – Patlatus
    Dec 12, 2022 at 10:25
  • I'm not sure you'll get an answer to this unless someone internal pipes up, but it's what I've seen from the outside. Had a package bouncing off security review for ages now. Fails on the first tiny thing they find and then I have to get it turned around again. Because of the crappy rerports and the fact that we have > 150 false positives to explain it's not a quick process, so it tends to take me a while to find the time to do it between each review. Then of course the code's moved on in that time as well. Chasing my own tail.
    – Matt Lacey
    Dec 13, 2022 at 13:38
  • I know. Same here. I also shared this in internal Partner groups and hope someone officially answers here. Dec 13, 2022 at 13:39


You must log in to answer this question.

Browse other questions tagged .