Marketplace Policies

The VeloCMS marketplace is curated, not open. Every plugin and theme goes through automated and human review before becoming available to tenants. This keeps quality high and protects the users who rely on the platform — it is not the developer-hostile gatekeeping you might expect from other marketplaces, but genuine review by people who use the tools.

Review SLA

  • Automated stages (1-4): Complete in under 10 minutes after upload.
  • Human review (Stage 5): 1-3 business days for new submissions. Expedited review (same business day) is available for Pro developer accounts and for minor version updates that touch only non-behavioral code (e.g., dependency bumps, README updates).
  • Re-submissions after rejection: Treated as new submissions. If you fix exactly the cited issues and only those issues, typical turn-around is 1 business day because reviewers only re-check the flagged areas.

Common rejection reasons

The following account for roughly 80% of rejections. Check these before submitting:

  • Manifest ID doesn't follow reverse domain notation (must contain at least one dot, all lowercase, only alphanumeric and hyphens)
  • Capabilities over-declared relative to what the code actually does (automatic rejection by Stage 2)
  • No test file included — the review pipeline requires at least one passing test
  • Description does not match observed behavior (causes a soft reject with a note)
  • Missing permissions_displayed_to_user array — tenants need plain-language consent copy
  • No preview/thumbnail.png for theme submissions
  • Plugin imports a heavyweight bundle (e.g., entire lodash or AWS SDK) instead of tree-shaking specific utilities — causes bundle size failure

Soft vs. hard reject

A soft rejectmeans "fixable issues found — here's what to change and resubmit." You receive a structured list of issues with line-level references where possible. No appeal required; just fix and resubmit.

A hard reject means a policy violation that is not fixable with edits — for example, code that exfiltrates member data to an undeclared endpoint, or deliberate obfuscation to hide behavior from the scanner. Hard rejects lock the submission and require explicit review team approval to try again.

Revenue share and payouts

VeloCMS takes 20% of every paid plugin or theme sale. You keep 80%. There are no listing fees, no monthly dev fees, and no minimum sale threshold before payouts. Stripe Connect Express handles payouts directly to your bank account — funds settle on Stripe's standard payout schedule (typically 2 business days after the charge clears).

Subscription plugins bill monthly. The split applies per billing cycle, not per month — so monthly subscribers generate monthly revenue shares.

Appeal process

Disagree with a rejection decision? Email [email protected] with the submission ID and a clear description of why you believe the decision was incorrect. Appeals go to a second reviewer (not the original one) within 2 business days. If the appeal succeeds, the submission is moved to the front of the review queue.

Plugin removal after publication

Published plugins can be removed for security violations (immediate, no warning), policy violations discovered post-publication (24-hour notice except for security issues), or by your own request. When a plugin is removed, installed tenants keep their version but cannot install fresh copies. We notify affected tenants by email.