# New app security questions

**URL:** <https://devforum.zoom.us/t/new-app-security-questions/93435>\
**Category:** App Submission\
**Tags:** securityreview\
**Created:** [August 15, 2023, 9:15pm UTC](https://devforum.zoom.us/t/new-app-security-questions/93435 "2023-08-15T21:15:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ron.jailall](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ron.jailall/32/611_2.png) [@ron.jailall](https://devforum.zoom.us/u/ron.jailall)\
**Post date:** [August 15, 2023, 9:15pm UTC](https://devforum.zoom.us/t/new-app-security-questions/93435/1 "2023-08-15T21:15:30Z")

</div>

We’re starting the development of a new app and want to make sure we don’t have any issues when we get to the review stage. The new app registration mentions a few items to check, are all of these required for passing the review process?

Specifically the 3rd party penetration testing, or soc2 compliance, or iso27000 compliance.

We do use SAST and SSDLC practices.

---

<div class="post-metadata">

**Author:** ![nigel.hughey](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nigel.hughey/32/52665_2.png) [@nigel.hughey](https://devforum.zoom.us/u/nigel.hughey)\
**Post date:** [August 18, 2023, 5:59pm UTC](https://devforum.zoom.us/t/new-app-security-questions/93435/3 "2023-08-18T17:59:12Z")

</div>

Hello Ron,

The items in the Security section are not necessarily hard requirements. If you use use SAST and SSDLC practices, then describe this in detail in your Technical Design Document, and the Security Team will follow up with if they have questions.

You can read more about Security best practices for Marketplace apps here: [Security Best Practices](https://developers.zoom.us/docs/distribute/security-best-practices/)

Regards,  
Nigel Hughey  
Marketplace Operations

---

<div class="post-metadata">

**Author:** ![nigel.hughey](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nigel.hughey/32/52665_2.png) [@nigel.hughey](https://devforum.zoom.us/u/nigel.hughey)\
**Post date:** [August 18, 2023, 7:54pm UTC](https://devforum.zoom.us/t/new-app-security-questions/93435/4 "2023-08-18T19:54:52Z")

</div>

For more details:

> [@Evidence Guidelines for Your Marketplace App](https://devforum.zoom.us/t/evidence-guidelines-for-your-marketplace-app/93270):
>
> Evidence Guidelines for Your Marketplace App We accept all forms of documentation and ask that you include it in your Technical Design Document. This includes certificates, diagrams, and written documentation. Security evidence documentation (SSDLC, SAST/DAST etc.) is required for these app review requests: Request for an Authorization URLs (Beta) \*If you have a specific use case you would like to inquire about, reach out to [marketplace.security@zoom.us](mailto:marketplace.security@zoom.us). In addition, please submit security…