App Development Rules

Marketplace apps must protect merchants and their customers throughout development, operation, update, suspension, and uninstall. Passing review never authorizes undocumented behavior.

Security

• Request least privilege and explain every scope.
• Use HTTPS and exact redirect URIs; use Authorization Code with PKCE S256.
• Keep tokens and secrets on the server and out of logs.
• Never use service-role credentials or trust tenant identity from the browser.
• Enforce tenant and scope authorization server-side and fail closed.
• Do not access undocumented APIs, private routes, databases, schemas, or RPCs.

Privacy

• Collect only the minimum data needed for the declared purpose.
• Provide accurate privacy and support information.
• Do not perform hidden tracking or cross-merchant profiling.
• Document retention, export, deletion, and uninstall handling.
• Never combine merchant data for an undeclared secondary purpose.

Reliability

• Use bounded retries with jitter and idempotency for webhook processing.
• Do not depend on undocumented event ordering or an event name that is not verified emitted.
• Handle provider and SaaS failures without silent data corruption.
• Respect the documented rate limits and Retry-After.
• Preserve merchant control during update, suspension, and uninstall.

Portability

Use only documented SaaS contracts and configuration supplied for the authorized environment. Never depend on a fixed domain, LAN or Docker address, cloud-provider hostname, region, internal Supabase address, Kubernetes service, cluster topology, or internal Edge routing.

Uninstall and data handling

Stop API access and refresh attempts when authorization is revoked. Disable app-side jobs and subscriptions promptly. Do not delete, mutate, or hold merchant data as retaliation or surprise behavior. Follow the merchant-facing retention and deletion terms you declared.