Every version of every extension is checked automatically, then read by a person on the Webfaze team before sites can install it.
1. Automatic checks (straight after upload)
The report marks problems as Blocks (must fix), Check (a reviewer will ask about it) or Note. Fix what blocks, raise the version and upload again.
2. Human review
Usually within 5 working days for a new extension and 2 for an update. Updates that ask for no new permissions are quickest. You're emailed the result. Reviewers check the developer guidelines, including:
- the extension does what the listing says, and nothing else;
- it asks only for the permissions it uses, and the description explains each one;
- no tracking of visitors, no injected adverts, no data sent anywhere the owner wasn't told about;
- readable code, not minified or obfuscated beyond normal bundling, and no secrets in it;
- honest listings: real screenshots, no fake ratings, no other brands' logos.
Version states
- Failed checks: fix and upload a higher version.
- In review: nothing to do.
- Changes asked: the reviewer's note says what to change.
- Approved: signed and offered to sites.
- Rejected: not published. You can reply to the decision.
- Pulled: removed for a problem and switched off on every site that runs it. Fix it and upload a new version.
Signing
An approved version is signed by the Webfaze directory. When a site owner presses Review and install, their server checks the signature and the checksum before installing, so a single changed byte is refused. Sites only install extensions from the directory; files can be pasted in only on a developer's test site in developer mode.
Sites see Update available for a new approved version. If it asks for new permissions, the owner agrees to them before updating.