Review Process
Exactly what the automated scan blocks vs. warns on.
The automated Review System scans your submission's manifest + extension assets. Nothing here ever inspects your backend — it never runs on Prebit's infrastructure, so there's nothing to scan.
Blocking (rejects the submission)
| Check | Why |
|---|---|
<script src="https://..."> (external, absolute URL) | Reviewed assets must be self-contained — no loading code from a developer-controlled origin |
Dynamic import(...) | Reviewed extension assets must not load code at runtime |
javascript: URIs in href/src | Not allowed at all |
<object>/<embed>/<applet> tags | Not allowed at all |
Inline event-handler attributes (onclick=, onerror=, ...) | Use addEventListener instead |
eval() / new Function(...) | Must not execute code that wasn't part of the reviewed, hashed artifact |
A fetch()/XHR target not covered by a declared network_origins entry | network_origins is the allowlist — every network call must be declared |
Total asset size over performance_budget.bundle_kb | |
CSS asset size over performance_budget.css_kb |
Any one of these rejects the whole submission — nothing is partially accepted.
Warning (non-blocking, shown to you)
| Check | Why |
|---|---|
document.write(...) | Can break rendering inside the extension host, but not blocked outright |
A manifest blocks/embeds entry with no matching asset file found | Best-effort presence check — a real name-to-file mismatch you probably want to fix |
What's checked once, not per-asset
- Publisher signature (if your org has registered a signing key) — verified against the exact manifest hash + sorted asset content hashes.
versionnot already submitted for this app (semver must strictly increase per release).
After the automated scan passes
A submission that passes automated scanning still needs manual review:
permissions requested, screenshots, pricing, privacy/support URLs. The
automated scan is what makes a CLI-side prebit validate/build
trustworthy — it's the literal same code path the server runs, not an
approximation — but passing it is necessary, not sufficient, for approval.
Verify locally before submitting
prebit validate ./prebit.app.toml ./assets
# or, to also stage a submission-ready dist/:
prebit build .Both run parseManifest + scanSubmission from @prebit/sdk — the exact
functions mirrored from new-frontend's server-side Review System. See
CLI.