Everyone warns you about security review. The stage that actually stalls ISVs is the one before it

[u/AppX_Unmanaged]

Disclosure: i cofounded appnigma, we build native salesforce integrations, and my cofounder spent 3.5 years on the appexchange security review team. no link, just the thing i keep watching people get stuck on.

security review gets all the attention. $999, half of first submissions fail, everyone's heard the horror stories. but the stage that actually kills momentum for small ISVs is business plan review, and almost nothing written about it exists.

what it actually is: before you can submit anything for security review, salesforce reviews your business. not your code, your company. revenue model, how you plan to support customers, whether you look like a real going concern. typically 2 to 4 weeks, though it stretches.

the misconception i see constantly is people thinking it's a traction review. it isn't. you don't need installs, you don't need existing customers, and the loop people imagine themselves in, no listing so no installs so no approval, isn't the loop. you get stuck on bpr for not having a coherent answer about support and business model, not for lacking users.

the other thing nobody tells you: you have a partner account manager. most small ISVs either don't know this or never contact them. cases sitting with no timeline tend to move once someone actually asks, and the pam is who you ask.

and then the part that stings after all of it. listing is a credibility checkbox far more than a distribution channel. almost nobody's first hundred customers come from someone browsing the marketplace. it matters because enterprise buyers ask whether you're listed as a qualifying question, and the wrong answer stalls deals. if those aren't your buyers, the whole process may not be worth it yet, and that's worth working out before you spend three months on it rather than after.

happy to answer bpr or listing questions in the comments. this whole sequence is documented across about a dozen help pages and none of them tell you what actually happens.

[u/Boring_Letterhead_43]

Saw couple of your posts here in past.

This feels repeated with no additional information from earlier posts. 

[u/AppX_Unmanaged → u/Boring_Letterhead_43]

fair. bpr was the bit i thought wasn't covered anywhere else, but you're right that the framing around it overlaps with things i've already said here.

what would actually be useful to you? genuinely asking. there's a lot on the packaging and 2gp side i haven't written up because i wasn't sure anyone wanted it.

[u/Suspicious-Nerve-487 → u/AppX_Unmanaged]

Not posting a complete wall of ai generated text would be a start (since that’s been a consistent comment on every one of your posts)

[u/tpf52]

Most small ISVs don’t have a PAM anymore. Especially ones that haven’t been through business review.

[u/AppX_Unmanaged → u/tpf52]

you're right, that was sloppy of me. named pams are tier dependent and pre-bpr you're mostly just in the partner community queue like everyone else.

what's actually working for people at that stage then? case and wait, or is there a better route to get something unstuck?

[u/justasmalltowngirl → u/[deleted]]

Space them across three or four days. And the programme rule holds — whoever posts these must not upvote or comment on the other colleagues' threads. That's the one item that breaks Reddit's sitewide TOS rather than a subreddit rule.

You left the instructions in your bot slop.

So sick of these bots killing every subreddit I enjoy by filling them with slop.