Update QSM

Author: NicoletaComan

content/en/docs/marketplace/upload-content/governance-process.md

@@ -21,7 +21,7 @@ Mendix checks the following:
   There should be no use of GPL, LGPL, or MPL licenses.    
   For more details, refer to [Open-Source Software Licenses](/appstore/submit-content/#license).
 * For malware in the *.mpk* files, using the [VirusTotal](https://www.virustotal.com/gui/home/upload) tool.
-* For third-party vulnerabilities, using the [Snyk](https://snyk.io/) tool.
+* For third-party vulnerabilities, using QSM. If critical or high vulnerabilities are found, the component is rejected.
 * That the component can be used without errors in a specific Studio Pro version, if the component is a widget, a module, a connector, or an industry template.
 * That the documentation mentions all the details per the template, for example, dependencies, configuration, and how to use the component.
 * That the grammar, alignment, and spelling for the component's description and documentation are correct.
@@ -31,7 +31,7 @@ Mendix checks the following:
 It may sometimes take a few iterations for a component to be approved, depending on the issues identified. To avoid a high number of necessary iterations, make sure you have followed the [Guidelines for Content Creators](/appstore/guidelines-content-creators/) and have performed the checks above before you submit a component for approval.
 
 {{% alert color="info" %}}
-Review and approval by Mendix is required only for the first version of a publicly-listed component. Subsequent versions of a public component do not need review or approval by Mendix.
+All subsequently uploaded versions of a public component must be scanned and approved by Mendix.
 
 Private Marketplace content does not require any review or approval.
 {{% /alert %}}