Salesforce AppExchange Development Company

Review timelines and approval planning

Salesforce's published guidance has cited approximately four to six weeks for a complete security-review submission. Its more detailed review-stage guidance provides stage estimates, including time for submission checks, initial testing, and resubmission. Actual timing can change with submission completeness, review volume, and the issues found.

Treat these estimates as planning guidance, not a guaranteed approval date. The complete product launch may take longer because architecture, development, testing, documentation, business approval, and listing preparation occur before or alongside the review.

Scanning tools and common findings

Salesforce's current developer documentation requires Salesforce Code Analyzer reports for applicable managed-package security reviews and also describes the Source Code Scanner, referred to as Checkmarx. Check the current submission instructions for the exact reports required. See the Code Analyzer submission guide.

Areas to review include:

• Access checks and permissions for records and objects.
• Unsafe handling of user input and dynamic queries.
• Exposure of sensitive information in logs, responses, or configuration.
• Weak authentication, session handling, or external-service controls.
• Insecure data sharing and overly broad access.
• Vulnerable third-party libraries or external components.
• Incomplete error handling and insufficient security documentation.

Automated tools can flag code that requires investigation. A finding should not be dismissed simply because the app works as expected. The freelance appexchange developers should determine whether it represents a real vulnerability, fix the issue where necessary, and document the evidence for any genuine false positive.

What happens if an app fails?

A failed review doesn’t mean you have to re-build the product. The team should go through the security report, reproduce the results, assess the scope of the results, fix the root causes and test the fixed package. Salesforce’s security-review process documentation describes how findings and resubmissions are handled.

The freelance appexchange developers should repeat the required scans, produce new reports and submit the revised version, following the instructions in the Partner Console. A returned submission may require missing information or test access rather than remediation of code; follow the status and instructions shown for that submission. The number of attempts at a review cannot be predicted in advance. It is contingent upon the app, the quality of the initial preparation and the issues identified.

Pre-review readiness checklist

Use this checklist before submitting your product:

• Confirm the package type and partner distribution requirements.
• Review object, field, record, and component access.
• Check sharing rules, permission sets, and least-privilege access.
• Test input validation, error handling, and data exposure.
• Review authentication and external API connections.
• Run the required Salesforce Code Analyzer scans.
• Run the required Source Code Scanner checks.
• Fix actionable findings and record evidence for false positives.
• Rerun scans after remediation and save the updated reports.
• Prepare a working test org, test credentials, and installation steps.
• Complete product documentation and submission answers.
• Verify the current review fee and applicable submission requirements.

Project Overview

• Industry: B2B software
• App type: Custom Salesforce CRM application
• Project duration: 12 weeks
• Development team: 2 Salesforce developers, 1 QA tester, and 1 Salesforce consultant
• Security review: 2 submission attempts
• Main requirements: Custom objects, automated workflows, user permissions, package configuration, and licensing setup

Challenges

The client relied on manual processes to manage customer requests. It wanted a Salesforce app that could organize these requests, automate routine tasks, and provide a consistent experience for users. The app also needed proper testing, package configuration, and preparation for the AppExchange security review.

Solution

The team discussed the client requirements and planned the design of the app. The required Salesforce features were built and workflows put in place to reduce the manual effort of the developers. The team tested the app and checked user access. The team reviewed package settings and prepared the documents needed for submission.

The team found issues that need to be fixed before submission during testing. It fixed the problems and sent the app in for a second security review. Our appexchange app consulting company also reviewed licensing needs and created a plan for delivering future app updates to customers.

Results

• 12 weeks of development
• 2 submissions
• 30% less manual work
• Improved process consistency