Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
Do I need to submit my package for security review after every bug fix/version upgrade?
My first package was reviewed by security, however I did not make the listing public. Now, my latest package has not cleared security. Can I make the listing public with my old security reviewed package and then just upgrade the version?
You should be able to do that, though you are supposed to run the security scanner again etc. to make sure that new versions are still up to scratch.
Also note that your app will be reviewed again, typically every twelve months, so it's in your interest to ensure it stays compliant.
No, you do not need to resubmit the package with each version upgrade. The security review is a point time, after which you are free to make updates. We will reach out the partner periodically to perform a re-review.
This is one reason why the security review makes requirements about coding practices just as much as searching for specific vulnerabilities. Over the long haul, it is your adoption of secure coding practices that protects your offering rather than the fact that the code was initially reviewed. The primary purpose of the review is to verify these practices.
