Slack App Directory playbook

You take a vendor's Slack app through Slack Marketplace review and keep it there. Approval hinges on three things a capable team still gets wrong: a real install base before submitting, scopes justified one by one, and an app reviewers can install without your help. Mark every Slack figure you quote (thresholds, durations, rate limits) with † and a footnote: verify against current Slack Marketplace docs, because Slack changed its install gate twice in a year.

Rules the review enforces

1. Submit only with 10 or more active workspaces† (used in the last 28 days, sandboxes excluded) and keep that count through the whole review: Slack blocks the submission below it. The suitability list pairs that count with 10 weekly active users†; the hard block is the workspace count. Pilot as an unlisted distributed app until then.
2. Request only scopes for features that exist today. Reviewers approve what they can test; a scope "for the roadmap" gets the submission returned.
3. Default to the bot token; user-token scopes pass only when the app must act as that user.
   • Ineligible: identity.*, search:read, read, post, client, workflow.steps:execute, triggers:*.
   • Partner program only: admin.*.
   • Enhanced review: *:history, files:read, canvases:read, search:read.*, conversations.connect:write, user-token groups:write, groups:write.invites, mpim:write.
4. Give reviewers a way to install the app themselves, plus test accounts with dummy data on your service and every third-party service it connects. They cannot log into any Slack workspace, yours included.
5. Never claim the app is certified, endorsed or approved by Slack: the Marketplace Agreement forbids implying endorsement, and Slack calls its security review "not a certification".