Developer levels

The level shown by mainsdk info, the Main mark and the trust page comes from a record MainSDK Cloud signs; the CLI checks the signature against MainSDK's published keys (and any in MAINSDK_DEVELOPER_KEYS) before it shows a level.

This level vouches for who stands behind the app and how they work. It does not mean the app is free of bugs.

Developer

• Signed in with GitHub through mainsdk login.

Verified

• A person passed identity verification with a provider, or an organisation proved its domain, its GitHub organisation and its registration.

Trusted publisher

• Verified.
• On a paid plan (Teams or Fleet).
• At least 6 months of green Main marks.
• Releases are signed.
• A security contact is published.
• A disclosure policy is published.

Certified partner

Price set later.

• Trusted publisher, plus a review by MainSDK of how the partner builds and supports apps. Listed now; price set later; not yet available.

How a level is lost

• A known-exploited issue unpatched past its 7-day clock drops Trusted publisher to Verified.
• A revoked signing key drops Trusted publisher to Verified until a new key signs a release.
• A confirmed incident drops Trusted publisher to Verified until the cause is fixed and an appeal is accepted.
• Status is recomputed every hour and reviewed once a year.