QuickBooks app security review: the complete requirements checklist

Everything Intuit's security review actually checks before your QuickBooks Online app can list — and how to self-check each item before you submit, so you don't lose a cycle to a rejection.

Last updated 2026 · ~9 min read

If you're building an app on the QuickBooks Online API, the security review is the step that catches most people off guard. The requirements are published, but they're spread across a dense page, and a single missed item — a wrong cache header, a cookie flag, a token stored the wrong way — sends you back into the queue for another cycle. This guide walks through every requirement in plain terms, grouped the way Intuit's reviewers actually evaluate them, with a concrete way to check each one before you submit.

How the review actually works

Listing on the QuickBooks App Store means passing three stages: a technical review, then a security review, then a marketing review. The security review only starts once the technical review passes. Intuit lists an average of about a week for the initial security review, but that number swings widely with how many issues turn up.

The important thing most first-time submitters miss: after the initial review, you must remediate any critical, high, or medium priority issues before you can publish. And for apps already live, those same issues must be fixed within two weeks of Intuit notifying you — a clock that keeps running for as long as your app is listed.

Server & transport requirements

These are configuration-level and among the most common silent rejections, because they're easy to overlook and easy to verify from the outside.

Attack-vulnerability requirements

During the security test, Intuit checks that your app is protected against a specific set of vulnerabilities. Test and resolve these before submitting:

• Cross-Site Request Forgery (CSRF) — token-based protection on state-changing requests.
• Cross-Site Scripting (XSS), both reflected and stored — input validation plus output encoding.
• SQL Injection and XML Injection.
• Authentication, session management, and functional-level access control.
• Validated forwards and redirects — any redirect logic must be validated against open-redirect abuse.

These are the checks a general-purpose scanner can help with — but a scanner won't tell you which findings map to Intuit's review, or how they weight severity. The value is in mapping scanner output to Intuit's exact list and clearing the noise.

QuickBooks data-usage rules

These are policy rules with zero overlap with any scanner — they're about what your app does with data, and they're strict:

• Your app must not provide third parties with access to a customer's QuickBooks data, via external API calls or any other means.
• Your app cannot export, save, or store QuickBooks data for any purpose other than the functional use of your app.

Cookie & session requirements

OAuth token management

This section trips up more submissions than any other, because the rules are specific and prescriptive — a scanner has no concept of them:

• Intuit OAuth tokens and customer-identifying information must never be exposed in your app or shared with other parties.
• After the OAuth flow completes, the refresh token and realmID must be encrypted and stored in persistent memory.
• The refresh token must be encrypted with a symmetric algorithm — 3DES or AES, with AES preferred.
• Your AES key must be stored in your app in a separate configuration file, not inline.

The token-endpoint redirect rule

This one is subtle and easy to miss. Web endpoints that receive sensitive customer information or authentication tokens in URL parameters must not return HTML content in the response body. Returning HTML risks leaking those values to third parties through the subsequent Referer request header.

Instead, those endpoints should implement a 302 Found redirect — especially anywhere your app handles authentication tokens.

Check: probe any token-bearing endpoint and confirm it responds with a redirect, not an HTML body.

After you publish: the annual re-review

Passing once isn't the end. Apps listed on the QuickBooks App Store — and any app with more than 500 connections — are reviewed by Intuit annually, or more frequently at their discretion, to confirm they still meet the technical and security requirements. Intuit can also require you to complete a security affidavit or produce reputable scan results within two weeks of a request. In practice this means the requirements above aren't a one-time gate; they're an ongoing compliance obligation you need to keep passing.

How to self-check before you submit

The requirements split cleanly into two kinds, and you check them differently:

• Runtime / deployment rules (HTTPS, TLS, cache headers, cookies, TRACE, the 302 rule) can be verified from the outside by probing your deployed app. These are deterministic — a header either satisfies the rule or it doesn't — so they're the fastest to confirm and the easiest to automate. The free Preflight Action covers exactly these.
• Source-level rules (OAuth token encryption and key storage, the data-usage rules, and the XSS/CSRF/injection set) need access to your code or a deeper review. These are where the full Preflight review and expert triage come in.

Working through both before you submit is the difference between a clean pass and finding out about a problem only after Intuit sends it back.

FAQ

How long does the QuickBooks app security review take?

The security review starts after the technical review passes. Intuit lists an average of about seven days for the initial security review, though it varies with how many issues are found. For ongoing compliance reviews, critical, high, or medium issues must be fixed within two weeks of notification.

Why do QuickBooks apps get rejected in security review?

Common reasons include missing no-store cache headers on sensitive pages, session cookies without Secure and HttpOnly, unencrypted OAuth refresh tokens, endpoints returning HTML instead of a 302 redirect when handling tokens, TRACE left enabled, and unresolved XSS, CSRF, SQL injection, or XML injection findings.

Do I need to pass the review again after publishing?

Yes. Apps listed on the App Store, and any app with more than 500 connections, are re-reviewed annually or more often at Intuit's discretion to confirm they still meet the requirements.

This guide summarizes Intuit's publicly documented security requirements for informational purposes. Preflight is an independent tool and is not affiliated with, operated by, or endorsed by Intuit. Passing these checks does not guarantee your app will pass Intuit's review. Always refer to Intuit's official developer documentation for the authoritative, current requirements.