Seller Upload Security Checklist

This checklist reduces avoidable risk but does not certify that a product is secure. Marketplace scanning or review can require quarantine or manual action and does not replace the seller’s own release process.

Before migration, also verify the complete product migration checklist and restricted-product guidance.

Before uploading a product, take a few minutes to remove avoidable risk.

Buyers should receive the product, not your local machine.

Remove secrets

Check for:

API keys.
Private keys.
.env files.
Database dumps.
OAuth secrets.
Test credentials.
Internal hostnames.
Personal access tokens.

If it should not be public, it should not be in the package.

Remove development clutter

Unless required for the product, avoid shipping:

Local logs.
Cache directories.
Temporary files.
Editor settings.
Build artifacts that are not needed.
Dependency folders that buyers should install themselves.

Match the listing

The package should match:

Product name.
Version number.
License terms.
Documentation.
Compatibility notes.
Changelog.

Scan and review

Run your own checks before relying on marketplace review.

For compiled products, include enough documentation for buyers to understand what they are installing. For source products, make the structure understandable.

Make setup safer

Avoid install scripts that make broad system changes without warning.

Document required permissions, network calls, external services, and any background processes.

Good upload hygiene protects buyers and helps sellers avoid review delays.