Meanwhile this is what Salesforce does for their AppExchange applicants: https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/s

Meanwhile this is what Salesforce does for their AppExchange applicants: https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_overview.htm#:~:text=The%20review%20process%20is%20rigorous,vulnerabilities%20found%20during%20the%20review https://developer.salesforce.com/docs/atlas.en-us.packagingG.... [Edit] I should add that an annual listing is $150 and the initial security review is $2550, so no free cheese either.