WebAppBazaar review standards

1. Content moderation — Admin reviewed

Every app submitted to WebAppBazaar undergoes an Admin review before publication. We review submissions for compliance with our content standards and reserve the right to reject apps containing prohibited racist, hateful, or excessively violent content.

Our review focuses on content suitability for publication, not a comprehensive technical security audit. Automated technical checks and trust indicators, where available, provide additional information but do not guarantee an app’s safety.

Our goal is to build a useful, welcoming directory where developers can showcase their work and users can discover web applications with greater confidence.

2. Automated technical checks — Trust signals

These automated, point-in-time checks assess the criteria below where available. They are separate from Admin content review and are not proof that an app is safe.

• Fetches the submitted URL, records its HTTP response and request duration. The HTTPS signal means the submitted URL uses HTTPS and the fetch succeeds; it is not a certificate or vulnerability audit.
• Requests Google PageSpeed performance scores for mobile and desktop. These are synthetic performance measurements, not tests of mobile usability.
• Samples up to 12 links found in the returned HTML. It tries HEAD, then GET if HEAD fails. It does not crawl the entire app or test links rendered only by JavaScript.
• When enough page text and the AI service are available, generates a summary, SEO description, tags, suggestions and possible suspicious-content flags. These are fallible AI interpretations, not proven findings.

How the 0–100 trust score is calculated

Reachability and HTTPS · up to 25 points

25 for a successful HTTPS fetch with a response below 400; 10 for a reachable response below 400 without the HTTPS signal; otherwise 0.

Performance · up to 25 points

Mobile score × 12/100 plus desktop score × 13/100, each rounded. If both are unavailable, request duration under 1,500 ms earns 15 points; under 3,500 ms earns 8; otherwise 0. A single missing PageSpeed score earns no points for that profile.

Sampled links · up to 25 points

Round(25 × (1 − min(1, 4 × broken links / checked links))). If no links can be checked, the current model awards 10 points; this does not prove all links work.

Content flags · up to 25 points

25 minus 8 per suspicious-content flag, with a minimum of 0. When AI analysis is unavailable, the current model still awards these points for zero recorded flags. This is missing evidence, not proof of clean content.

The total is clamped to 0–100. Automated badges start at 70 (Verified), 80 (Gold) and 90 (Platinum). These tiers describe only the automated score, not the Admin content-review decision. None implies a human security review, developer identity verification, or secure payments.

A high score cannot establish that an app is secure. The scan does not inspect source code, authentication, data handling, purchases, account editing, cancellations, malware, or legal compliance. N/A means unmeasured, not passed.

When results change

Developers and administrators can request scans. A completed rescan updates the stored report and listing score. There is no scheduled repeat-check service or continuous monitoring currently running. Results may become stale between scans; update dates are not scan dates.

3. Independent security review — Your choice

WebAppBazaar does not offer human security reviews. If you want a more detailed security assessment than our automated AI-assisted scan provides, you need to hire an independent security reviewer yourself. This is optional and is not required for a listing or automated badge.

Examples of independent services you can contact:

• Cobalt ↗ — web application penetration testing by security specialists.
• Cure53 ↗ — penetration testing, source-code audits and security assessments.

These links are provided for reference, not as endorsements or partner services. You choose and hire the reviewer directly; scope, fees and terms are agreed with them, not WebAppBazaar. Only authorize testing of systems you own or have permission to test. Ask for a written scope, dated findings and guidance on fixing identified issues. An independent review does not guarantee safety or automatically change your WebAppBazaar score or badge.