Verification, stated plainly
A badge that means everything means nothing. Here is exactly what each tier is evidence of, and exactly what it is not.
Unverified
An account with an email. Nothing has been checked.
- — List builds
- — Sell through escrow
- — Instant payout
- — Certified badge
- — Featured placement
- — Exclusive license sales
Verified merchant · Tier 1
Government ID and liveness check completed with our KYC partner. They hold the documents; we hold a pass or fail and a jurisdiction.
- — Everything unverified can do
- — Featured placement
- — Exclusive license sales
- — Payout after the dispute window
- — Instant payout until a reserve is built
Certified build · Tier 2 path
A specific artifact reviewed against a published checklist, plus a merchant with cleared escrow history and a rolling reserve.
- — Certified badge on the reviewed build
- — Instant payout while reserve-backed
- — Certified shelf placement
- — Transfer certification to a different build or version
Certification Checklist v1.2
A certified build passed a review against these eight items at a specific hash on a specific date. Findings at or above the severity floor are published on the listing rather than fixed quietly.
- 01
Source read
Every file in the delivered bundle is read, not sampled. Generated and vendored directories are listed separately.
- 02
Dependency provenance
Every direct and transitive dependency resolved to a published version with a known registry origin. Unpinned or vendored-with-modifications dependencies are named in the report.
- 03
Outbound network inventory
Every host the code can contact at runtime, and under what condition. Telemetry that is not disclosed in the listing is a fail.
- 04
Secret handling
No committed credentials, no keys baked into builds, no logging of tokens or request bodies containing them.
- 05
Reproducible build
Clean checkout, documented commands, a build that completes without undocumented local state.
- 06
Auth and access control
If the build has accounts, every privileged path is checked for a server-side authorisation decision.
- 07
Input handling on trust boundaries
Request bodies, query parameters, uploads, and webhook payloads reaching a database, filesystem, or shell.
- 08
Documentation accuracy
Documented behaviour is checked against the code for the paths a buyer would integrate against first.
What certification is not
- — Not a guarantee the build has no vulnerabilities. No review can produce that claim honestly, and any marketplace that makes it is one incident away from owning the liability.
- — Not a warranty of fitness for your use case. Read the listing limits.
- — Not permanent. It applies to the reviewed hash. A new version needs a new review, and the badge shows which version it covers.
- — Not a substitute for escrow. Certified builds still ship through the same held-funds flow.