Draft — pending legal review
How we review listings
Last updated: 14 October 2026
Buyers deserve to know what they're installing. Every product goes through a review before it's listed — but no review can guarantee software is 100% safe, so we're upfront about what we check and what we don't.
Automated scanning
Every uploaded file is scanned for malware signatures, exposed secrets (API keys, tokens) and known-vulnerable dependencies.
Workflow exports are checked for embedded credentials and unexpected outbound calls.
Human review for higher-risk types
MCP servers, plugins and agents that request network access or credentials are reviewed by a person before they can be published.
We check that declared permissions match what the code actually does.
What this does — and doesn't — mean
A 'security-reviewed' badge means a listing passed our checks at the time of review. It is not a guarantee that a product is free of every bug or vulnerability.
Always review permissions, use least-privilege credentials and test in a safe environment first.
Reporting a problem
If you find something suspicious, tell us at security@botaisle.com. We can pull a listing and re-scan it at any time.