# Build and List Your Salesforce AppExchange Product | SynconAI > AppExchange app development: second-generation managed packages, LWC and Apex, security review preparation, listing and upgrades, from a team with its own app. Publisher: SynconAI Canonical HTML: https://synconai.com/appexchange-product-development Markdown cite: https://synconai.com/appexchange-product-development.md Contact: contact@synconai.com ยท +61 2 7813 0221 ## What is AppExchange? AppExchange product development is the work of designing, building and releasing an app that other Salesforce customers install from AppExchange: second-generation managed packages built in Lightning Web Components and Apex, Salesforce security review preparation, partner and listing setup, licensing and versioned upgrades. SynconAI built its own AppExchange app, WorkNotes Plus, and delivers this work for software companies in the United States, Australia and worldwide. - AppExchange is the Salesforce marketplace where customers find and install apps that run inside their orgs. - Most AppExchange apps ship as managed packages, with your namespace, protected code and upgrades you control. - Before a managed package can be listed, it has to pass the Salesforce security review. ## Building your AppExchange product services - Product and package design: Data model, permissions, namespace and what customers can configure. - LWC and Apex build: Lightning Web Components and Apex, written for multi-org installs. - Second-generation packaging: Managed 2GP versions built from source, with a release process. - Security review preparation: Code Analyzer scans, fixes and the submission documents reviewers ask for. - Partner and listing setup: Partner Console, listing content and license management. - Upgrades and support: Versioned releases, push upgrades and support after launch. - Install and admin guides: The documents your customers and their admins need. ## Does your idea need a managed package? Four questions decide how your product should be packaged. 1. The idea: What problem it solves inside Salesforce. 2. Who installs it: Your own orgs or other companies. 3. What it touches: Objects, data and permissions it needs. 4. Where it runs: Fully in Salesforce or with your own service. Decision: Will other Salesforce customers install it? - Managed package on AppExchange: Second-generation managed package, security review and a listing. - Unlocked package: For your own orgs, when nobody else installs it. - API product with a listing: Your service connects to Salesforce and is reviewed as an API solution. ## What does it take to build an AppExchange product? Each piece of work leaves something your team keeps. - Product and package design (Architecture and package design): Data model, permissions, namespace and configuration. - LWC and Apex build (Source repository you own): Components and logic written for multi-org installs. - Second-generation packaging (Package versions and release notes): Managed versions built from source. - Security review preparation (Scan reports and false-positive notes): Scans, fixes and submission documents. - Listing setup (Listing copy and screenshots): Listing content prepared in Partner Console. - Licensing and trials (License management setup notes): License Management App connected to your package. - Upgrades and support (Release plan and support runbook): Versioned releases and push upgrades. - Customer documentation (Install and admin guide): What admins need to install and configure it. ## What goes inside a managed package? Five layers, designed so the app installs cleanly in orgs you have never seen. - User interface (Lightning Web Components): Record pages, App pages, Custom labels, Accessibility - Business logic (Apex): Service classes, Trigger handlers, Async jobs, Test classes - Data model (Objects and settings): Custom objects, Custom metadata, Namespaced fields, Sharing - Security (Access the app respects): Permission sets, Object and field checks, Sharing enforced, Named credentials - Package (How it ships): Namespace, Managed 2GP, Versions, Push upgrades ## What are the steps to list on AppExchange? From joining the partner program to the first customer install. 1. Your company to Salesforce Partner Program: Joins as an AppExchange partner 2. SynconAI to Your company: Builds and versions the managed package 3. SynconAI to Your company: Prepares scans and review documents 4. Your company to Security review: Submits through Partner Console 5. Security review to Your company: Returns findings or approval (a person) 6. Your company to Salesforce Partner Program: Publishes the listing 7. Customers to Your company: Installs from AppExchange 8. SynconAI to Customers: Ships upgrades ## How do you prepare for the AppExchange security review? What reviewers look for, grouped the way we prepare it. - Code - Salesforce Code Analyzer run and results kept - Object and field access enforced in Apex - Sharing declared on every class - No credentials in code - External services - Every external endpoint listed - Scans of web apps and APIs you host - Authentication and encryption documented - Submission - Version promoted to managed-released - Package built from your partner Dev Hub - Test org access for reviewers - False positives explained in writing ## The tools we build AppExchange products with Salesforce tools throughout, so your team can carry on without us. - Second-generation managed packages (Packaging): Versions built from source control. - Salesforce CLI (CLI): Package versions, scratch orgs and deployments from scripts. - Dev Hub and scratch orgs (Orgs): A clean org for every feature and test run. - Salesforce Code Analyzer (Scanning): The scan security review asks for, run on every build. - Lightning Web Components (UI): The standard Salesforce component model. - AppExchange Partner Console (Partner): Security review submission and listing management. - License Management App (Licensing): Installs, trials and licenses tracked per customer. ## How does an AppExchange product move from build to launch? Three stages, each with one goal. Your proposal states the dates. - Build, A package that installs cleanly. - Package design agreed - LWC and Apex built and tested - Managed versions released - Review and list, Approved and listed. - Scans run and findings fixed - Security review submitted - Listing prepared - After launch, Customers stay current. - Versioned upgrades - Push upgrades where agreed - Support and fixes ## Cost and timing The first step is a free 60-minute architecture review of your AppExchange product setup, with a written plan you keep. Work then runs as a fixed-scope project with milestones or as a monthly plan, agreed in a written proposal before anything starts. Plans: https://synconai.com/pricing ## FAQ ### What is AppExchange product development? Designing, building and releasing an app other Salesforce customers install from AppExchange: managed packages in LWC and Apex, security review preparation, partner and listing setup, and upgrades. ### What is a second-generation managed package? The current Salesforce way to package an app for distribution. Versions are built from source control through a Dev Hub, carry your namespace and can be upgraded in customer orgs. ### Does every AppExchange app need a security review? Managed packages and API solutions distributed on AppExchange must pass the Salesforce security review before they can be listed. ### Do upgrades need another security review? Upgrades to a package that passed review do not go through the full review again. Salesforce can still run periodic reviews, so security stays part of every release. ### How long does the security review take? Salesforce runs the review and sets its timing. Preparing scans and documents thoroughly is the part we control, and it reduces rounds of findings. ### Have you built your own AppExchange app? Yes. SynconAI built WorkNotes Plus, an enterprise notes app for Salesforce, so we work through packaging and AppExchange steps on our own product too. ### Who owns the code? You do. The source repository, package and namespace belong to your company, and we hand over the release process with them. ## Where we work AppExchange product development for organizations across the United States and Australia, and worldwide. Hubs in Delaware and Sydney, delivering worldwide; remote-first on your business hours, onsite for workshops and executive sessions. ## Related - WorkNotes Plus: https://synconai.com/worknotes-plus - Salesforce development: https://synconai.com/salesforce-development - Salesforce integration services: https://synconai.com/salesforce-integration-services - Salesforce org health review: https://synconai.com/salesforce-org-health-review ## Cite When citing SynconAI Building your AppExchange product, link https://synconai.com/appexchange-product-development or https://synconai.com/appexchange-product-development.md.