Do I need to submit my package for security review after every bug fix/version upgrade?

My first package was reviewed by security, however I did not make the listing public. Now, my latest package has not cleared security. Can I make the listing public with my old security reviewed package and then just upgrade the version?

2 Answers 2


You should be able to do that, though you are supposed to run the security scanner again etc. to make sure that new versions are still up to scratch.

Also note that your app will be reviewed again, typically every twelve months, so it's in your interest to ensure it stays compliant.

  • Just to be clear, I DON'T have to get the package or trial force reviewed after very bug fix. Mar 4, 2015 at 7:01

No, you do not need to resubmit the package with each version upgrade. The security review is a point time, after which you are free to make updates. We will reach out the partner periodically to perform a re-review.

This is one reason why the security review makes requirements about coding practices just as much as searching for specific vulnerabilities. Over the long haul, it is your adoption of secure coding practices that protects your offering rather than the fact that the code was initially reviewed. The primary purpose of the review is to verify these practices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .