Portal Community
InstallHub

Package Trust Levels

Every marketplace package carries a trust level that communicates how much verification has been performed. Trust levels range from automated-scan-only (Community) to full human review (Certified) to BizFirstGO-authored (Official).

Phase 3 — PENDING This feature is planned but not yet implemented.

Trust Level Comparison

CriterionOfficialCertifiedCommunity
PublisherBizFirstGO / AnthropicVerified organizationAny registered user
Automated security scanYes — PASS requiredYes — PASS requiredYes — PASS required
Human security reviewYes — internal teamYes — BizFirstGO reviewerNo
Identity verificationAlways verifiedDomain verification requiredEmail verification only
Test coverage requirementYes — internal standardsYes — minimum 70%No
README completeness checkYesYes — all sections requiredNo
Production install recommendationYesYesUse with caution

Official Packages

Official packages are authored and maintained by the BizFirstGO engineering team or Anthropic. They represent:

Official packages are guaranteed to work on the current platform version and are updated with every major platform release.

Certified Packages

Certified packages go through a multi-step review process:

1

Publisher Verification

The publisher verifies their organization by adding a DNS TXT record or uploading a verification file to their domain.

2

Automated Checks

Security scan (PASS required), manifest completeness, README completeness, SemVer compliance.

3

Human Review

A BizFirstGO reviewer inspects the package contents for quality, security, and compliance with marketplace guidelines.

4

Certification Granted

The package receives the Certified badge. Future versions require a lighter review (automated checks + spot review for major versions).

Community Packages

Community packages have passed the automated security scan. They have not been human-reviewed. Best practices for Community packages:

← Version Management Next: Ratings and Reviews →