:: Salesforce / AppExchange app development
AppExchange app development, built to pass security review
Selling an app on AppExchange means more than writing code. It has to install cleanly in thousands of different orgs, upgrade without breaking, and pass Salesforce’s security review. We help software companies design, build and package apps that do all three.
Managed packages
Security review preparation
Upgrades that don’t break orgs
:: What we do
What we do for AppExchange partners
From first idea to listing, or picking up an existing package that needs work.
01
Product and architecture
Which parts live in Salesforce and which in your own cloud, how data flows, and how the app will scale.
02
Managed package development
Apex, Lightning Web Components and metadata built as a second-generation managed package with a namespace.
03
Security review preparation
Code scans, fixes for common findings, false-positive documentation and a test org ready for reviewers.
04
Connected apps and APIs
OAuth, connected apps and secure calls between your product and the customer’s Salesforce org.
05
Licensing and listing
Licence Management App setup, trial orgs and help with the AppExchange listing content.
06
Upgrades and support
Versioning, push upgrades and fixes as Salesforce releases change the platform.
:: App architecture
Four ways to build an AppExchange app
The right architecture decides how hard the security review is, how upgrades work and what your app can do inside a customer’s org.
Native
Managed package (2GP)
Everything runs inside Salesforce: objects, Apex, Lightning components and Flows. Simplest to install and the most trusted by admins.
Hybrid
Package plus your own cloud
A light package inside Salesforce, with heavy processing, AI or storage on your servers. Common for data and analytics apps.
Connected
Connected app only
Your product stays outside Salesforce and connects through OAuth and APIs. Quickest to build, but less visible inside Salesforce.
AI
Agentforce actions in a package
Packaged actions and prompt templates that let customers’ Agentforce agents use your product.
:: How it works
How an AppExchange project runs
A first version usually takes three to five months, including security review.
Weeks 1 to 3
Design
Architecture, data model, packaging approach and a security plan agreed before code.
Months 1 to 3
Build
Development in sprints, tested in many org types and editions.
Month 3 to 4
Review prep
Scans, fixes and documentation for the Salesforce security review.
Launch
List and support
Listing live, licensing set up and a plan for the next versions.
:: Security review
How to pass the AppExchange security review
Salesforce reviews every app before it can be listed. Most failures come from a short list of issues that are easy to fix early and expensive to fix late.
01
Design for review from the start
Respect sharing and field-level security in every query, avoid storing secrets in code and keep external calls to known endpoints.
02
Run the scanners
Use Salesforce Code Analyzer on your package and a web scanner such as OWASP ZAP or Burp Suite on any external service. Fix every high finding.
03
Document false positives
Some findings are not real issues. Write a short explanation for each one, because reviewers will ask.
04
Prepare test environments
Give reviewers a working test org, credentials for external services and clear steps to use every feature.
05
Submit through the Partner Console
Pay the review fee, complete the questionnaire and attach scan reports and documentation.
06
Respond quickly to feedback
If the review fails, fix the listed issues, re-scan and resubmit with notes on each change.
:: Checklist
Security review checklist
Check these before you submit. They are the most common reasons we see apps sent back.
Before you submit
CRUD and field-level security checked in Apex
No hard-coded credentials or API keys
All external endpoints use HTTPS and are documented
Code Analyzer and web scan reports attached
Test org and test logins ready for reviewers
Clear install and configuration guide
Common reasons apps fail
SOQL injection from unescaped user input
Queries that ignore sharing rules
Sensitive data stored in plain text
Outdated JavaScript libraries with known issues
External services without a scan report
:: Cost and timeline
How much does AppExchange app development cost?
Typical prices for our AppExchange work, based on senior developers at $25 to $35 an hour. Salesforce’s partner and security review fees are separate.
Security review prep
$5k – $15k
3 to 6 weeks
Scans, fixes and documentation for an existing app, through to submission.
New managed package
$25k – $60k
3 to 5 months
A first version of your app as a 2GP managed package, built for review and listed on AppExchange.
Full ISV product
$60k – $150k+
5 to 9 months
A larger app with external services, licensing, upgrades and a release process for ongoing versions.
Ongoing costs
Plan for Salesforce’s partner programme and revenue share, a periodic security re-review, and updates for each of Salesforce’s three releases a year.
What moves the price
Native versus hybrid architecture
Number of objects, screens and features
External services that need scanning
Licensing and feature management
Number of Salesforce editions supported
:: Why Sterling
What you get
A managed package you own
Security review documentation
Automated tests across org types
A release and upgrade process
Code and IP in your repository
:: Tools we use
2GP Managed Packages
Apex
Lightning Web Components
Salesforce DX
Code Analyzer
Licence Management App
Connected Apps
Heroku
AWS
4.9
Average rating on Clutch · 350+ projects since 2019
:: Questions
Questions about AppExchange apps
What is AppExchange app development?
How long does AppExchange security review take?
Do we need to be a Salesforce partner to list an app?
Should our app run inside Salesforce or connect to it?
Can you take over an existing managed package?
What is Salesforce AppExchange?
What is a managed package?
What is the AppExchange security review?
What happens if our app fails the security review?
How do ISVs make money on AppExchange?
Can you build the external service behind our app too?
:: Related Salesforce services
Other ways we can help
Send us your brief. We’ll help turn it into reality
A senior engineer replies within one business day with questions or a first plan: approach, team, timeline and estimate.