Completing Google Security Assessment Before Launch

Just got security approval from Google's chosen CASA firm.

I was going for a Tier 2 approval which allows my app to use sensitive Gmail scopes (like delete mail).

The security assessment took ~2 weeks comprising:
1. Code scanning - I'd upload code, they'd flag issues, I'd fix it and retry
2. Security practices questionnaire - they asked questions and then would ask for evidence when my answers needed more proof
3. Pen testing my app - I momentarily freaked out when I saw someone actively trying to hack me in the server logs... then remembered I had paid for this
4. Write up the approval letter

I still have to wait up to 5 days for Google to approve after they receive the letter.

I'm enjoying this "can't launch" downtime because it gives me an excuse to work on some "dev lifestyle" aspects of my app.