Trust, review & safety
How every submission is reviewed before it lists, what buyers can rely on, and the rules that keep the marketplace safe to run code from.
The Solo Market sells code that runs on your own computer, so trust is the whole product. This page explains what every tool goes through before it's listed, what you can rely on as a buyer, and the honest limits of any review.
Every tool is reviewed before it lists
Nothing goes live automatically. When a seller submits a tool, it enters a review queue and is checked against a fixed list before it can appear in the catalogue:
- Fresh-machine test. A reviewer runs the tool on a clean setup, following the seller's
SETUP.md. It has to actually run — in about five minutes. - Readable source. No obfuscated or minified-only code. If a reviewer can't read what it does, it doesn't list.
- Disclosed behaviour. Every network call and dependency must be declared in the tool's
manifest.json. Undisclosed activity is a rejection. - Honest listing. The description and demo have to match what the tool really does.
Tools that pass earn the “Verified — runs in 5 minutes” badge. That badge is the whole point of a curated marketplace: it means a person already got this running and read the code.
Every tool is checked before it's listed. We run an automated security scan of the source code (flagging network calls, obfuscation, and data-exfiltration patterns), then a human reviews the results and the code by hand before approving. We can't guarantee compatibility with your setup, and you run downloaded software at your own risk — but nothing reaches the marketplace unreviewed.
What you can rely on as a buyer
- It runs, or your money back. A 14-day guarantee on every purchase — if a tool won't run, you're refunded, no questions asked. See the Refund policy.
- It runs on your machine, not ours. Your data stays on your computer. There's no account required to run a tool and no telemetry the marketplace adds.
- You can re-download forever. Purchases live in your library; a tool you bought doesn't disappear.
- You can read the code. Source is required to be readable, so you — or an AI assistant — can inspect what you run.
The honest limits
Review reduces risk; it can't erase it. Because these tools run on your own machine rather than ours, we can't guarantee a tool is compatible with, or safe on, your specific setup, and you run downloaded software at your own risk. Sensible habits still apply: read the README.md, glance at the source or ask your AI assistant to, and don't hand a tool credentials it has no reason to need.
See something wrong?
What this means if you're selling
The bar above is also your checklist. Ship readable source, declare every network call, and make sure your SETUP.md genuinely works on a clean machine. Do that and review is quick. The full requirements are in the App Package standard and Get your project live.