Salesforce ECA Security Compliance for AppExchange ISVs: A Technical Breakdown of the Four OAuth Controls

If you received Salesforce’s mandatory security email in late April 2026 and immediately started questioning which of the four OAuth controls actually apply to your AppExchange application — you are not alone. The email landed without much context. The official documentation is written for a broad audience that includes everything from simple connected apps to complex multi-flow enterprise integrations. And the ISV partner community Slack channels filled up with the same question repeated across