← Back to the developers overview

The archive is never extracted or executed during the checks. These are rejected:

• broken or encrypted ZIPs; more than 10,000 files; a file over 16 MB or over 256 MB in total;
• paths with “..”, hidden segments (starting with “.”), symlinks or unsafe characters; case-insensitive duplicates;
• suspiciously compressed files (ratio over 100 — a zip-bomb sign);
• ClamAV antivirus findings;
• a missing or invalid extension.json, theme.json or language-pack.json, an invalid signature or a mismatch with the manifest;
• in a theme: any file other than theme.json, the listed screenshots and the plain-text documents.

Version statuses: Uploaded → Submitted (automated checks passed, waiting for a moderator) → Approved → Published. Or Rejected — with the reason and the moderator’s comment under Submissions.

• POLICY_VIOLATION — breaks the catalogue rules.
• SECURITY_RISK — a security risk, or the automated checks failed.
• INCOMPLETE_METADATA — incomplete description, manifest or translations.
• BROKEN_FUNCTIONALITY — the package does not work as described.
• LICENSE_VIOLATION — licensing problems with code or assets.
• OTHER — something else, explained in the comment.

Fixed it? Submit a new version with the same code and a higher version number. The same version cannot be submitted twice.

Developer documentation