When do I have to submit for security assessment

[bjaskulski]

I wanted to publish my app on Google Cloud Platform, when I bumped into the fact that using sensitive scopes (Sheets API in this case) requires me to verify my app.

I am fine with that, but I cannot understand exactly the process. Is my app required to be submitted to security assessment, period.

I've seen some exceptions to the fact that the security assessment is needed, but unfortunately my app wouldn't hit any of those points (maybe the limit of users, but that potentially only in an early stage).

The scope that is required to me is whole CRUD for google sheets with endpoint googleapis.com/auth/spreadsheets

Is there any possibility that I would not be required to undergo security assessment or it's there by default and I will be obliged to pay a fee for such an audit?

[davidsalomon]

Leave it as internal (if you use Google Workspace) and have tests users (up to 100) if the API will be only for your use. You need to run the verification process if you make your app public.

[bjaskulski]

Thanks for the answer @davidsalomon 

I definitely have to go public with the app. The main question is whether verification process always comes with security assessment from an external researcher.

[sbazyl · Accepted solution]

3rd party security assessments are only required for a few specific scopes clasified as restricted -- see https://developers.google.com/terms/api-services-user-data-policy#additional-requirements-for-specif...

Sensitive scopes currently don't require a 3rd party assessment. The app will still get some more scrutiny during reviews to review usage of those scopes, but it mostly comes down to justifying the use of the scopes and data and providing a video showing how the scopes are presented in the context of the app.