I was under the assumption that after 1 year a managed package should again go thru security review. However I published a free app that passed the security review at 26-1-2022. Since then I published few upgrades that automatically approved, as expected. Today when I submitted a new released (17-2-2023) I was expecting that it will go thru full review, but it again approved automatically.

Is it ok? Can I know when it will go thru full review process?

1 Answer 1


Security Re-Review does not have a specific, defined timeframe. From the ISVforce Guide:

To identify which listed solutions are due for re-review, we consider potential risk and the amount of time since the solution was listed. To determine potential risk, we run risk-factor reports. If your solution shows significant change, it’s likely that we conduct a re-review. The usual re-review timeframe is six months to two years after the solution was listed. However, if your solution’s risk factor is low, it may not be flagged for re-review.

Emphasis mine.

Your experience may vary. Don't worry about it until you're asked to submit for re-review.

  • It is worth mentioning that the security review process has some changes happening to it, specifically around fees - which appears to impact free app listings too. There will be a live Q&A session on 23th Feb at 08:30 PT. The meeting link is buried in the comments on this partner forum posting at the end of a comment from Shawna Moran.
    – Phil W
    Commented Feb 17, 2023 at 7:14
  • Thanks for the answer I didn't know that. + the potential changes around the apps fees seems drastic. If indeed it will effect also free app it might remove any interest to publish such apps.
    – Liron C
    Commented Feb 17, 2023 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .