What we check before a listing goes live
Eight automated stages, then a human. Here is what each one is actually looking for.
Every uploaded version runs through eight stages before a reviewer sees it: identity, archive integrity, malware, secrets, structure, dependencies, static analysis and demo health.
The secrets stage finds more real problems than the malware stage. Sellers do not usually ship malware; they routinely ship a .env file with a live API key in it, having tested the build the night before. We catch it, we tell them, and we tell them to rotate the key, because by the time it is in a zip file on our servers it should be considered compromised.
A human still makes the final decision. The automation exists so that the human is looking at the listing rather than at a virus scan result.
More from the blog
Why every balance on DevMall is derived, not stored
A seller balance column is a bug waiting for a concurrent refund. Here is what we do instead.
Six licences, not sixty
Sellers wanted custom licence text. We said no, and buyer disputes fell.
How to price a licence ladder that people actually climb
Extended should be a multiple of Commercial, not a surcharge on it. Here is why.