I was under the assumption that after 1 year a managed package should again go thru security review. However I published a free app that passed the security review at 26-1-2022. Since then I published few upgrades that automatically approved, as expected. Today when I submitted a new released (17-2-2023) I was expecting that it will go thru full review, but it again approved automatically.
Is it ok? Can I know when it will go thru full review process?
Security Re-Review does not have a specific, defined timeframe. From the ISVforce Guide:
To identify which listed solutions are due for re-review, we consider potential risk and the amount of time since the solution was listed. To determine potential risk, we run risk-factor reports. If your solution shows significant change, it’s likely that we conduct a re-review. The usual re-review timeframe is six months to two years after the solution was listed. However, if your solution’s risk factor is low, it may not be flagged for re-review.
Emphasis mine.
Your experience may vary. Don't worry about it until you're asked to submit for re-review.
