Quote in 48 hours
Get a custom quote
Fixed-fee scoping in 24 hours. No sales pitch.
TL;DR. Salesforce AppExchange requires every managed package to pass a mandatory security review before listing. The review takes 6 to 9 weeks, costs $999 per attempt for paid apps, and roughly half of first-time submissions fail. The DAST scan you submit is, in practice, a penetration test. Atlassian, ServiceNow, and Microsoft now have similar requirements.
Salesforce reviews every package with Checkmarx CxSAST, Salesforce Code Analyzer, and a partner-supplied DAST report.
Chimera was retired June 16, 2025. You must now bring your own DAST scan from OWASP ZAP, Burp Suite, or Qualys.
Failed submissions cost $999 each, plus 2 to 3 weeks per resubmission cycle.
Atlassian Marketplace requires an annual CREST-accredited penetration test, refreshed every October.
If you are building a B2B SaaS product on Salesforce and want to distribute it through AppExchange, you will hit a mandatory security review before a single customer can install your app. Roughly half of first-time submissions fail. The review takes 6 to 9 weeks. And since March 2023, every failed submission costs you another $999.
This guide covers exactly what the AppExchange security review requires in 2026, what role penetration testing plays in getting approved, how long the process takes, and what other major SaaS marketplaces now have comparable requirements. If you are an ISV working toward a listing, bookmark this page.
What is the Salesforce AppExchange security review?
AppExchange listings hinge on a passing security review — effectively a penetration test of your managed package.
The Salesforce AppExchange security review is a mandatory code-level and behavioral audit that every managed package must pass before it can be listed on AppExchange, whether the app is free or paid.
Salesforce reviews every app using a combination of three methods:
Static analysis
Salesforce runs your code through Checkmarx CxSAST and the Salesforce Code Analyzer, which catches pattern-level vulnerabilities such as SOQL injection, missing field-level security enforcement, hardcoded credentials, and unsafe Apex DML operations.
Dynamic application security testing (DAST)
Since Salesforce retired its Chimera scanner in June 2025, partners must run their own DAST scan using OWASP ZAP, Burp Suite, or Qualys against their demo org and submit the report as part of their submission materials. This is where penetration testing becomes directly relevant: the DAST report is a required submission artifact.
Manual review
The Salesforce Product Security Team reviews the package against eight defined categories: authentication and session management, authorization and sharing model, input validation, output encoding, cryptography, communication security, logging and error handling, and secrets storage.
Every one of the apps live on AppExchange went through this same process. There is no shortcut and no fast lane.
Does AppExchange require a penetration test?
This is the most common question ISVs ask, and the honest answer is: effectively yes, though Salesforce does not use the words "penetration test" in its documentation.
Here is what Salesforce actually requires:
A DAST scan report from OWASP ZAP, Burp Suite, or Qualys, run against your demo org, submitted with your application.
A Solution Architecture Document describing your data flow, integration surface, sharing model, and external endpoints.
A populated demo org with test credentials that reviewers can use to exercise every feature.
The DAST scan is penetration testing methodology. Running Burp Suite against your application to identify injection points, session management issues, and authentication weaknesses is what a penetration tester does. The difference is that Salesforce is prescribing the tool, not requiring you to hire a firm. Many ISVs benefit from having a security professional run and interpret those scans rather than doing it themselves, particularly because Salesforce reviewers also run their own internal pentesting-style checks and will flag issues your self-scan missed.
The most common failure pattern is not a dramatic exploit. It is a CRUD and field-level security enforcement gap in Apex code: queries missing WITH SECURITY_ENFORCED or DML operations missing Security.stripInaccessible. These are pattern issues, not vulnerabilities, but Checkmarx catches them and Salesforce will reject your submission.
How much does the AppExchange security review cost?
As of March 2023, Salesforce moved to a per-attempt fee model:
Paid apps: $999 per submission attempt, including every resubmission after a failed review.
Free apps: $0 per submission.
No partner-tier discount exists. Every ISV pays the same rate.
If your app fails and you resubmit twice before passing, you have paid $2,997 in fees, before accounting for engineering time and any deals that slipped because your listing was delayed.
The hidden cost is not the fee. It is the 6 to 9 week delay multiplied by the enterprise deals in your pipeline that were conditioned on your AppExchange listing.
How long does the AppExchange security review take?
The full review cycle averages 6–9 weeks across five distinct milestones.
Here is the full timeline breakdown:
Stage | Duration |
|---|---|
Pre-queue validation | 1 to 2 business days |
Initial security review | 6 to 9 weeks |
Resubmission after failure | 2 to 3 weeks per attempt |
Version update (auto-approved) | Minutes, via self-review wizard |
Version updates of an already-approved app are auto-approved in minutes via the self-review wizard introduced in March 2023, unless the update introduces new Salesforce objects, new external callouts, or significant architecture changes. Those trigger a full review cycle.
Plan for the worst case: if your first submission fails and you need two resubmission cycles, you are looking at roughly five months between submission and listing. Start your security review preparation early, ideally during the final month of development rather than after you submit.
Do AppExchange apps require annual penetration testing?
Not on a fixed annual calendar, but in practice, yes.
Salesforce conducts what it calls periodic security re-reviews. These are triggered in two scenarios:
Salesforce identifies new vulnerability patterns in the ecosystem and notifies affected ISVs that their app requires a re-review.
You ship a significant update that introduces new objects, callouts, or data access patterns, which triggers a mandatory re-review via the self-review wizard.
In both cases, the $999 fee applies for paid apps, and the scope mirrors the initial review. Active ISVs releasing meaningful product updates typically go through review cycles roughly once a year. If your product is changing, treat pentest preparation as an annual budget line item, not a one-time cost.
Which other SaaS marketplaces require penetration testing?
Salesforce is no longer alone. Security review requirements are spreading across major enterprise SaaS platforms, and for ISVs building apps that touch enterprise data, the AppExchange is increasingly just one gate in a multi-marketplace distribution strategy.
Marketplace | Pentest required? | Cadence | Notable detail |
|---|---|---|---|
Salesforce AppExchange | Effectively yes (DAST report) | Per submission + periodic | $999 per attempt for paid apps |
Atlassian Marketplace | Yes, CREST-accredited | Annual, by October | Refreshed every April, enforced by end of October |
ServiceNow Store | NowScan required; external pentest accelerates | Per submission | Pentest evidence speeds approval for sensitive data apps |
Microsoft AppSource | Expected for higher compliance tiers | SDLC review at minimum | Publisher Security Program expanding since 2024 |
AWS Marketplace | Not mandatory; SOC 2 expected | Required for Competency designations | Pentest near-universal among enterprise ISVs |
Atlassian Marketplace
Atlassian has the most rigorous mandatory pentest requirement outside of Salesforce. All cloud apps on the Atlassian Marketplace, covering Jira, Confluence, and related products, must complete a penetration test before listing. Key details:
The test must be conducted by a CREST-accredited firm or through Atlassian's managed Bugcrowd program.
Annual renewal is required, per app. Enrolling one app does not cover your other apps.
Atlassian updates its security requirements every April and enforces them by the end of October.
Apps that fail to meet the updated requirements by the October deadline risk delisting.
For ISVs already navigating AppExchange, Atlassian Marketplace is the strongest parallel requirement to plan for. The CREST-aligned methodology used for Atlassian compliance also satisfies much of what Salesforce's DAST submission requires, making a single well-scoped engagement serviceable for both.
ServiceNow Store
ServiceNow requires partners to submit NowScan automated scan output as part of the listing process. External penetration test evidence significantly accelerates approval for applications handling sensitive enterprise data. For enterprise ISVs targeting ServiceNow's customer base, which skews toward large financial services, healthcare, and government organizations, treating the pentest as mandatory rather than optional is the right posture.
Microsoft AppSource and Azure Marketplace
Microsoft requires a security questionnaire and Software Development Lifecycle review for AppSource publishers. Penetration testing evidence is expected for publishers in higher compliance tiers, including applications targeting regulated industries or government buyers. Microsoft's Publisher Security Program has been expanding its requirements steadily since 2024.
AWS Marketplace
AWS does not mandate a pentest for listing, but SaaS products on AWS Marketplace are expected to carry SOC 2 Type 2 certification at minimum for enterprise buyer trust. Penetration test evidence is near-universal among ISVs pursuing AWS Competency designations, which are increasingly required for enterprise deals. See our SOC 2 penetration testing guide for the report format auditors and AWS buyers expect.
How to prepare for the AppExchange security review
If you are approaching your first submission, here is the preparation sequence that gives you the best chance of passing on the first attempt:
Run Checkmarx CxSAST locally before submission. Salesforce gives partners access via the Partner Security Portal. Fix every finding you can and document a false-positive justification for any finding you choose not to fix. The reviewer will see the same output.
Run Salesforce Code Analyzer. This open-source tool ships with the Salesforce CLI and catches PMD, ESLint, and RetireJS findings before you submit. Most CRUD and FLS failures show up here.
Run a DAST scan against your demo org. Use OWASP ZAP, Burp Suite, or Qualys, not Chimera (retired June 2025). Save the full report. You attach this to your submission in the Partner Community wizard.
Write your Solution Architecture Document. A diagram and narrative covering your data flow, every external integration, your sharing model, and where secrets are stored. The reviewer reads this first. A clear, thorough document reduces review time and signals that your team understands the security surface of your product.
Provision a complete demo org. Pre-load it with realistic data. Document login steps clearly. The reviewer will use this to exercise every feature your package exposes.
Submit through the Security Review wizard in the Partner Community. Pay the $999 fee for paid apps and wait for confirmation that your review has entered the queue.
How StealthNet AI helps ISVs get listed
Traditional pentest firms quote $15,000 to $25,000 and a 4 to 6 week timeline. For a seed-stage ISV with a single enterprise deal conditioned on an AppExchange listing, that is not a viable path.
StealthNet AI delivers marketplace-ready penetration test reports in 48 hours, starting at $1,500. Our AI agents perform autonomous exploitation across your web app, API, and infrastructure. A senior US-based ethical hacker validates every finding before the report is generated. Every report includes DAST output formatted to Salesforce submission requirements.
One-time engagements:
AI-Only: $1,500, 48-hour delivery
Hybrid (AI + Human): $5,000, 48-hour delivery, CREST-aligned methodology
Manual: $12,000+, for complex packages and multi-marketplace submissions
Annual plans for recurring re-reviews:
Starter Compliance Plan: $10,000/year
Growth Plan: $14,000/year (covers two marketplaces)
Security Maturity Plan: $25,000/year
See full pricing and our services overview, or learn more about our AI penetration testing platform. For a related compliance walkthrough, read our FDA penetration testing guide.
Get a scoped pentest quote for your AppExchange submission.
Frequently asked questions
What penetration testing tools does Salesforce accept for AppExchange submission?
Since June 2025, Salesforce accepts DAST reports from OWASP ZAP, Burp Suite, and Qualys. The Chimera scanner was retired on June 16, 2025. Any submission referencing Chimera output will require a new scan.
Can a free AppExchange app skip the security review?
No. All managed packages require the security review, paid and free. The difference is cost: free apps pay $0 per submission, paid apps pay $999 per attempt.
What is the most common reason AppExchange apps fail the security review?
Missing CRUD and field-level security enforcement on Apex DML operations and SOQL queries is the leading cause of failure, according to Salesforce developer documentation and ISV partner reports. The fix is adding WITH SECURITY_ENFORCED to queries or using Security.stripInaccessible before DML.
Does Atlassian Marketplace require the same DAST report as Salesforce?
No. Atlassian requires a full penetration test from a CREST-accredited firm or through Bugcrowd, which is a more comprehensive requirement than Salesforce's DAST submission artifact. A Hybrid engagement with StealthNet covers the CREST-aligned methodology needed for Atlassian while also producing the DAST output required for Salesforce.
How often does Salesforce require AppExchange apps to be retested?
There is no fixed annual schedule. Salesforce triggers periodic re-reviews when new ecosystem vulnerability patterns are identified or when a partner ships a significant architectural update. In practice, active ISVs are retested roughly annually.
Can one penetration test cover multiple marketplace submissions?
Sometimes. Salesforce and Atlassian have different scope requirements and submission formats. StealthNet can scope a single engagement to satisfy both simultaneously if your app is listed on or targeting both platforms. Contact us during scoping to confirm the methodology alignment.
StealthNet AI delivers AI-native penetration testing for ISVs, compliance teams, and security-conscious B2B SaaS companies. Reports are delivered in 48 hours and formatted to meet the submission requirements of Salesforce AppExchange, Atlassian Marketplace, ServiceNow Store, and Microsoft AppSource.