For a paid solution, Salesforce’s AppExchange security review currently costs $999 per attempt, including a resubmission. Salesforce says free solutions do not pay the review fee. The published timeline is typically four to five weeks, but that does not include your preparation, remediation, or the time needed for another attempt.
Salesforce is increasingly calling the marketplace AgentExchange; its current ISVforce guide uses that name for the security-review process. This article covers the same marketplace review commonly known as the AppExchange Security Review. Confirm the fee and workflow in Partner Console when submitting, since Salesforce can change them.
As an Amazon Associate I earn from qualifying purchases.
What should you budget for the review?
Separate the direct Salesforce fee from your team’s preparation and engineering work. Salesforce publishes the fee, but not an all-in project cost: internal labor, outside testing, and fixes depend on the solution and any findings.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Budget item | What to plan for |
|---|---|
| Paid solution review attempt | $999 per attempt, according to Salesforce Trailhead’s current page accessed October 7, 2026. A resubmission is another attempt and incurs another fee. |
| Free solution review | No review fee under Salesforce’s current ISVforce guide. Confirm the treatment shown in Partner Console before submitting. |
| Preparation and remediation | Variable; Salesforce does not publish a standard labor estimate or total project cost. |
| Schedule reserve | Plan for the published review stages plus time to address findings and, if needed, submit again. |
The per-attempt model replaced an older fee structure. Salesforce Developers reported in 2023 that the previous price was $2,550 for the initial review plus $150 annually, with the new $999-per-attempt model beginning March 16, 2023. Those older figures are historical, not current budgeting prices. See Salesforce Developers’ explanation of the fee change.
#1 Best Overall
How long does the AppExchange security review take?
Salesforce’s current ISVforce Guide estimates one to two weeks for readiness verification, then three to four weeks for first Product Security testing. For a resubmission that demonstrates progress on fixing vulnerabilities, it estimates two to three weeks of testing. Trailhead describes four to five weeks as a typical overall duration. These are estimates, not service guarantees; Salesforce says completeness and queue volume affect turnaround.
Readiness verification and security testing are distinct stages: an incomplete package can delay the point at which the review is ready to proceed. For a launch tied to a fixed date, schedule the first submission well in advance and reserve time for fixes and a possible additional attempt. That is a planning recommendation based on Salesforce’s stage estimates, not a promised Salesforce turnaround.
See the Salesforce ISVforce Guide to how the AgentExchange Security Review works and Trailhead’s submission guide for the published estimates.
What makes preparation take more or less time?
The work depends on architecture and submission readiness, so there is no reliable universal number of staff hours. Salesforce’s Trailhead submission guidance recommends preparing the materials reviewers need to understand and exercise the solution:
- Usage documentation and, where relevant, data-flow documentation showing exchanges between Salesforce and composite sites, mobile apps, or browser extensions.
- Scanner reports and explanations for findings believed to be false positives. Managed-package submissions must include Salesforce Code Analyzer reports or justify why they are not provided.
- Functional test environments, integrations, and reviewer credentials needed to test the app. Complete customer, administrator, and user documentation can also help.
Use Salesforce’s tailored checklist builder once you know the solution’s components. A checklist for a simple package may not fit an app that also relies on external services or client integrations.
Connected apps and external client apps
Salesforce Help’s guidance published September 8, 2026 says the review scope for Connected Apps and External Client Apps (ECAs) includes the packaged app configuration and integrations the solution uses. That scope can include web applications, REST APIs, mobile apps, browser plugins, and desktop apps. Salesforce says new integrations must use ECAs instead of Connected Apps.
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
For these integrations, plan to document why requested OAuth scopes are needed, use least-privilege scopes, explain any broad scopes, and describe how secrets are handled. Provide integration credentials to avoid delays. Salesforce says client keys for packaged ECAs can be shared in submission documents, but client secrets should not be shared there. Consult the Salesforce Help submission guidance for Connected Apps and External Client Apps.
What does the review check—and what does it not guarantee?
Salesforce’s older AppExchange Starter Pack for ISVs lists review targets such as SQL/SOQL injection, cross-site scripting, insecure authentication and access control, and platform-specific vulnerabilities. The current ISVforce Guide characterizes the review as a combination of enforcement and guidance, but says it is black-box and time-limited. Findings may describe classes of issues without enumerating every occurrence, and reviewers may not detect every issue type. Publishers remain responsible for finding and fixing all instances.
Salesforce recommends Code Analyzer for initial checks, but automated scanning cannot identify every issue that may appear in manual review. A clean scan is not approval, and passing review does not replace secure development and regular security checks. Salesforce Developers puts it plainly: “The Security Review is not there to find all the security issues for you, this is something that should be built into your development process and reviewed regularly.” Read Salesforce Developers’ preparation guidance for its Code Analyzer recommendations and limitations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
