GitHub OAuth + commit-signature challenge verifies ownership.
Static analysis, sandboxed live run, dependency + secret audit.
Weighted score across 10 dimensions, visible on every listing.
Buy-now, auction, rev-share, fractional, or license — you pick.