Scan. Score. Bond. Back it with a break-fix SLA.
Every certified listing moves through the same four gates. Buyers see the receipts before they pay; sellers carry real accountability after the sale. Here's the whole lifecycle.
Security scan
Static + dynamic analysis flags over-permissions, hardcoded secrets, injection surfaces and every outbound call.
Break-risk scorecard
Findings become a public, auditable scorecard with a 0–100 break-risk grade. Buyers read it before they buy.
Escrow bond
The seller posts a 20% maintenance bond, held in escrow for 90 days. No bond, no Certified badge.
90-day break-fix SLA
If an in-scope failure hits within 90 days, the seller fixes it free — or the bond funds a maintainer who does.
What a security scan actually checks.
Certification runs every submission through a battery of checks, then turns the results into the scorecard a buyer reads. The full scan is deeper than the free heuristic preview — but built on the same model.
Secrets & permissions
Hardcoded keys, tokens and private keys; over-broad scopes; anything the script can touch but shouldn't need to.
Injection & code-exec
Dynamic eval/exec paths, shell calls, and untrusted input flowing into an execution sink.
Dependency stability
Each outbound host scored against a watchlist of deprecation cadence, auth churn and rate-limit history — the real reasons automations break.
No scan certifies that any script is free of all vulnerabilities. Certification raises the floor and makes findings auditable — it is not a warranty of perfect security.
20% held for 90 days.
On every certified sale, 20% of the price is held in escrow. Think of it as the seller's deposit against their own promise.
- Seller delivers break-fix on time → bond releases to them at day 90.
- Seller goes quiet → the bond funds an independent maintainer to make the fix.
- Buyer is never left holding a broken script with no recourse.
Fixed free for 90 days.
The SLA defines exactly what "won't break" means — in writing, on every listing.
Dependency API changes · auth/token rotation · platform updates · defects the scan should have caught.
Edits you make · a service shutting down entirely · brand-new features · your infrastructure or credentials.
Need longer cover? Add a 12-month extended SLA at checkout for +25% of the listing price.
From submission to a closed sale.
Submit & certify — $99
Upload your n8n/Make export or script. Pay the one-time $99 certification fee. The scanner gets to work in minutes.
Scorecard & badge issued
You receive the break-risk scorecard. Grade A lists immediately; lower grades come with concrete conditions to clear first.
List live with bond
The 20% bond is reserved from your first sales. Your storefront shows the Certified badge — that's what closes hesitant buyers.
Bond releases
Deliver break-fix on any in-scope issue and the bond returns to you at day 90. Keep the badge live with a $49/mo Certified Seller plan and re-scan on every update.