How we review apps before they list

No app lists on Panoply without passing review. Not the first version, not an update, not an app from an established creator. This page is what happens between submitting and going live.

Why there's a review at all

Apps on Panoply are hosted and run in a buyer's browser. A malicious app could try to steal data or abuse the buyer's machine. Buyers can't read the source before buying — so somebody has to, and it can't be the person selling it.

The pipeline

1. Automated security scan

Your source is scanned for known-dangerous patterns. This is mechanical and fast: it looks for the categories in What review checks for and produces findings with severities.

2. Safety review

Marcus, Panoply's Head of Safety & Governance, reviews the scan output and the app itself, and writes a decision. The scan finds things; the review decides what they mean. A scan finding isn't automatically a rejection, and a clean scan isn't automatically an approval.

3. Approval and deploy

A human accepts the verdict. That single action approves the app and triggers the build — there's no separate confirm-then-publish step. Your app is deployed to <slug>.panop.ly and the listing goes live.

How long it takes

Review is a queue with people in it, so it isn't instant. While your app is pending, the submission page says so. There's nothing to poll and nothing you need to do — you'll see the status change.

What buyers see

The outcome is published on your listing: the categories checked with a passed or flagged mark against each, the reviewer's written note, when it was reviewed, and how many files were covered.

No score and no overall verdict are published, deliberately. Publication is the verdict.

What is not published is the machinery — the specific rules that fired, the patterns they matched, or the scoring. That's deliberate. Publishing the detection rules would tell a bad actor exactly what to avoid, which would make the review worth less to everyone.

Updates are re-reviewed

An update goes through the same pipeline. Your live version stays up while the update is in review, so an update that comes back for changes never takes your app offline. See Update or unpublish an app.

If changes are requested

A submission that doesn't pass comes back as changes requested — a written reason, a banner on the listing, and an email. A failed build lands the same way.

It isn't a rejection and isn't final: fix what was named and resubmit. Nothing counts against you. If you think the finding itself is wrong, see Report a problem.

(Removing a listing outright is a separate action, used for something that shouldn't be on the marketplace at all — not for an app that needs work.)