# App Vetting

> Check how a B2B SaaS marketplace reviews, re-reviews and removes third-party apps - the operator side. Answer a
> short interview and paste the re-review triggers and the enforcement ladder drafted so far; the browser ranks the
> review pipeline by the data apps can reach and by reviewer capacity, checks the triggers for objectivity, works out
> the publish-channel controls the marketplace needs, and audits the appeal and the ladder. Metered runs write the
> review-process design, and the developer policy. Built on the SkillSafe skill @samber/app-marketplace-review, from
> samber/developer-platform-skills (MIT), by Samuel Berthe.

https://app-vetting.skillsafe.ai/

## What is free
- The pipeline: a single hard gate, a staged gate with an objective fast path, a two-rung ladder or functional-only review, ranked by the most data an app can reach (regulated data keeps the hard gate) and by full-review hours against reviewer capacity, with the moves shown.
- Re-review and the channel: triggers read as objective (new OAuth scopes, new endpoints, changed data handling, a payment-model change, a new app type) or subjective; the controls required - FIDO 2FA and short-lived tokens for publishers, a 24-48 hour propagation hold when updates auto-propagate, OIDC publishing at scale, signed artifacts for auto-updated client code.
- Appeals and enforcement: rejections citing the policy, an appeal decided by someone else with a turnaround (dashboard-integrated for EU business users), and a six-rung ladder - finding, remediation SLA, listing hidden, installs suspended, tokens revoked, delisting - each with an owner, a notice period and its evidence. Plus a developer self-check, a ladder CSV, the checks (.csv) and everything (.json).

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (process or policy), `marketplace`, `controls`, `carry` (policy only: the process decisions) and `facts`.
- `process` replies with `summary`, `tiers`, `pipeline`, `admission`, `rereview`, `channel`, `appeal`, `kpis` and `caveats`.
- `policy` replies with `summary`, `minor_update`, `escalation`, `triggers`, `ladder`, `publisher`, `appeal_steps`, `runway` and `caveats`.
The page holds every reply to its own facts: the ranked pipeline, re-review and appeal, objective triggers, exactly the required channel controls, admission checks by mode and KPIs; an objective minor update, six owned rungs in order with notice and evidence, appeal steps from the cited policy and at least six months of runway.

## Links
- API tutorial: https://app-vetting.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/app-marketplace-review