Get your listing verified

The most common failure is a credential that was committed once, removed in a later commit, and is still sitting in history where anyone can read it. Removing the file does not remove the secret.

Rotate anything that was ever committed, then rewrite history or start a clean repository. A rotated key in history is a finding; a live one is a fail.

Your manifest lists the tools you expose, the scopes you need and the hosts you may contact. We compare it against what the software actually does, and a mismatch fails in both directions.

Asking for more than you use fails. So does using something you did not declare. The narrow, accurate manifest is both the easy pass and the thing buyers read first.

Agents are measured, not described. Provide a sandbox entry point and a handful of representative tasks, and they are run for the success rate, median time and cost per run once the sandbox runs: it waits on isolated infrastructure and has run nothing yet.

You can submit without this. Your listing will simply show blanks where the numbers go, and blanks convert badly, because buyers have been told to read them as absent evidence.

Verified with findings is a normal outcome and it is displayed as information rather than as a failure. Most real software has a dependency advisory somewhere.

What is not survivable is a manifest that understates what the software does. That is the one category we treat as disqualifying rather than informational, because it is the shape of a real attack.